How much roll-forward evidence does SOX ITGC interim testing need?
The evidence needed to roll interim ITGC results forward to year end depends on the risk and nature of each control, what the interim testing found, how long the remaining period runs, and whether internal control changed in the meantime. Inquiry alone is enough only when those factors point to a low risk that the control has stopped working. For a finance or IT leader who tested access or change controls in mid-year, the practical question is which controls fall outside that low-risk band and need documented roll-forward testing before management signs the 404(a) assessment as of fiscal year end. Section 404(a) of the Sarbanes-Oxley Act requires management's assessment of internal control over financial reporting as of fiscal year end, so an interim result is never the final answer. PCAOB AS 2201 paragraph 52 explains why timing matters: testing over a longer period and testing closer to the assessment date both give more evidence. Paragraphs 55 and 56 require roll-forward procedures when controls were tested at an interim date, and the note to paragraph 56 limits inquiry to cases of low risk. Management owns the controls and the evaluation. An implementation partner can prepare the change logs, access reports and evidence packages, but only the independent auditor issues the attestation report. Start by listing each ITGC tested at interim, then record the interim result, the remaining period and any system or personnel change since testing. Ask the auditor early which roll-forward evidence it expects for each control, and confirm the approach with them before the period closes. Keep the request as a written scope so the cost and effort of the extra testing are visible before year end.
Which factors set the amount of roll-forward evidence
AS 2201 ties the amount of roll-forward work to a small set of factors: how risky the control is, what interim testing found, how long the remaining period runs and whether internal control changed. For IT general controls, each factor maps to specific things in the environment that management and the auditor can check before deciding how much evidence to collect.
Control risk and nature
Higher-risk ITGCs need more roll-forward evidence. Privileged access, production change deployment and batch job oversight usually sit at the high end because a failure can alter financial data without anyone noticing. Lower-risk controls, such as periodic review of a read-only reporting group, can carry less. Check which controls protect IT-dependent automated calculations and whether any of them grant the ability to modify data or code.
Interim test results
Exceptions found during interim testing change the roll-forward picture. A single failed access review or an untracked emergency change means the control may have weakened during the year, and the roll-forward must show whether it was fixed and stayed fixed. Clean interim results support a lighter roll-forward, but only if the exception log, remediation tickets and retest evidence are complete and dated.
Length of the remaining period
The longer the gap between the interim test date and fiscal year end, the more evidence the auditor expects. A roll-forward covering a short tail may need only confirmation procedures, while one spanning a large share of the year usually needs samples drawn from that period. Record the interim cut-off date and the fiscal year end precisely so the period being covered is unambiguous.
Significant changes in ICFR
Changes to the environment after interim testing reset the baseline for the affected controls. Examples include a new ERP release, a change of identity provider, a move of financial reporting to a cloud platform, or a new administrator group with production rights. Compare the change log against the interim scope, and document whether each change affects an IT-dependent control or only operational efficiency.
Complex or subjective controls
Staff Audit Practice Alert No. 11 notes that inquiry is unlikely to be enough when a control is complex or subjective. Access reviews that rely on a manager judging whether a role is still appropriate, and segregation of duties rules that depend on how roles interact, need reperformance or sampled evidence. Ask whether the control owner must make a judgment, and whether the review record shows what was reviewed and what was decided.
Inquiry alone may suffice
AS 2201 allows inquiry alone as roll-forward only when the factors point to low risk that the control has stopped working. In practice this means a stable, low-risk ITGC with clean interim results, a short remaining period and no changes to the environment. Confirm each factor with records, not with the control owner's recollection, and treat any change in staffing or tooling as a reason to gather documents.
When inquiry alone is enough and when it is not
Inquiry means asking the control owner whether the control operated and changed during the remaining period, without examining new documents. PCAOB AS 2201 treats it as a roll-forward procedure only in narrow cases. A note to paragraph 56 says inquiry alone might be sufficient only when the factors indicate a low risk that the control is no longer effective. Staff Audit Practice Alert No. 11 adds that inquiry is unlikely to be enough when a control is complex, subjective or higher risk, when interim testing found exceptions, when the roll-forward period covers a significant part of the year, or when internal control has changed.
- Low-risk, stable controls: A simple control with no history of exceptions, no change in its design or owner, and a short remaining period may support inquiry, but only if the evaluator can document why the risk is low.
- Interim exceptions: Any exception found at the interim date generally takes the control out of inquiry-only consideration, because the question becomes whether the exception was fixed and whether it recurred.
- Long remaining periods: When a large part of the year falls after the interim date, inquiry alone is rarely enough, even for controls that were clean at interim.
- Changes to the environment: A system upgrade, a new approver, a migration to a new platform or a change in a service provider's report is an internal control change that usually rules out inquiry alone for the affected controls.
- Automated controls: Inquiry rarely shows that a configuration stayed the same, so confirm with the auditor whether change evidence from the change management system is expected instead.
Before relying on inquiry, confirm with the external auditor in writing which risk factors they weigh and how they record the low-risk conclusion.
This approach pairs inquiry with evidence that the control was watched during the remaining period, such as periodic reviews, management reports, exception logs, ticket queues or control self-assessments. SEC Release 33-8810 says that when ICFR risk is low, management may conclude that evidence from ongoing monitoring is sufficient without direct testing, and that its evaluation would ordinarily consider evidence from a reasonable period during the year, including fiscal year end. Monitoring evidence is only as strong as the monitor's independence and the precision of the review.
- Dated monitoring outputs: Reviews of access reports, change logs or job failure reports should show a date, a reviewer and the population reviewed, so the evaluator can see coverage after the interim date.
- Coverage of the full remaining period: Monitoring that stops at the interim date or runs only for a few weeks at year end does not cover the gap the roll-forward must close.
- Independence of the reviewer: A review performed by the control operator is weaker than one performed by someone who does not run the control, which affects how much weight it can carry.
- Precision of the review: A monthly summary that says "no issues" carries less weight than one that lists the criteria applied and the items investigated.
- Exceptions in the monitoring output: Any exception found in monitoring during the remaining period must be investigated and documented, or the reliance on that monitoring falls away.
Ask your auditor which monitoring reports they will accept as evidence and whether they need the underlying population to test the report's completeness.
Reperformance or sample testing means selecting items from the remaining period and examining the evidence directly, or re-running the control or a configuration check. AS 2201 paragraph 52 explains that testing over a longer period gives more evidence, and that testing closer to management's assessment date gives more evidence than testing earlier in the year. Paragraphs 55 and 56 require the roll-forward evidence to match the control's risk and nature, the interim results, the length of the remaining period and any significant changes in ICFR. This is the approach that most controls with exceptions, complex judgment or significant change will need.
- Sample from the remaining period: Selections should come from the population dated after the interim test, using a method the auditor can reproduce, such as a random or systematic selection.
- Configuration checks for automated controls: A current-state review of settings, roles or rule parameters at or near year end can confirm that the interim configuration still holds.
- Change population for program changes: Pull the full change population for the remaining period and test a sample against authorization, testing and approval evidence.
- Sample size tied to risk: Higher risk, a longer remaining period or a prior exception usually means a larger sample, so confirm the size with the auditor before testing starts.
- Timing of the test: Testing close to the assessment date gives more evidence, so schedule the procedure so that its results can be reviewed before the assessment is finalized.
When this approach is used, document the population, the selection method and any exceptions in a form another evaluator can reperform.
How a roll-forward runs from interim date to year end
The sequence takes a mid-year ITGC test result and extends it to the fiscal year-end assessment date, ending in a documented conclusion on whether the controls operated effectively as of that date. Each phase produces a specific artifact that the next phase depends on.
Confirm the interim test population and results
The control owner or the team running the test lists each ITGC tested at the interim date, the period covered, the population and sample sizes, and the exceptions found. Management or the testing team checks that the interim workpapers are complete and that each result links to the control in the matrix. The output is a signed-off interim results schedule that defines exactly what must be rolled forward. Any control with an open exception or an incomplete test is flagged before any further work starts.
Identify significant changes in the period
The team reviews change records, access reviews, system releases, personnel moves, configuration updates and any new applications or service providers from the interim date to year end. It compares these against the baseline described in the interim workpapers. Changes to the systems that support a control, or to the control itself, may alter its design and require fresh testing rather than extension. The output is a change log for the roll-forward period, with each change assessed as affecting or not affecting the control.
Assess risk and length of the remaining period
The team rates each control on its risk and nature, considering whether it is complex, subjective or automated, and how much of the year remains after the interim date. It also weighs the interim results and the changes found in the prior step. The output is a documented risk rating per control and a stated reason for the amount of roll-forward evidence each one needs. Controls with exceptions or significant changes move to the highest tier of evidence.
Choose the roll-forward procedures
Based on the risk assessment, the team selects the procedures: inquiry with corroborating observation, inspection of a sample of post-interim records, reperformance of the automated control, or a further full test. Inquiry alone is only defensible where the factors point to low risk that the control has stopped working, and the file should explain why. The output is a roll-forward plan that names the procedure, population and sample for each control, and the person responsible for it.
Gather and retain roll-forward evidence
The tester performs the selected procedures and collects dated, system-generated or independently sourced evidence covering the post-interim period. Each item is tied to the control, the sample selected and the period it covers, and stored in a location that cannot be altered after the fact. The output is an evidence index that lets a reviewer reperform the test without asking the control owner for context. Gaps in the index are resolved before conclusions are drawn.
Evaluate exceptions and the impact on related controls
The team reviews any exception found during the roll-forward and decides whether it indicates a control deficiency, and whether that deficiency affects other IT-dependent controls that rely on the same system or access. It records the severity assessment and the reasoning, and escalates to the SOX program lead and, where applicable, the external auditor. The output is an exception log with a disposition for each item, including any remediation plan that must be completed before year end.
Conclude on operating effectiveness at year end
The team combines the interim results, the roll-forward evidence and the exception dispositions into a single conclusion for each control, stated as of the fiscal year-end assessment date. The conclusion is reviewed by someone independent of the testing, then made available to the external auditor for their own roll-forward procedures. The output is a signed year-end operating effectiveness conclusion per control, which feeds management's Section 404(a) assessment.
Roll-forward gaps that PCAOB inspections cite
Inspection findings on roll-forward tend to cluster around a few predictable shortcuts: accepting inquiry where the standard expects more, dropping roll-forward work after an interim exception, and not reading system or access changes that happened after the interim date. Each card below names one gap and the check that exposes it before the auditor does.
Inquiry used for complex controls
Auditors may accept inquiry alone for roll-forward only when risk is low. Staff Audit Practice Alert No. 11 says inquiry is unlikely to be enough for complex, subjective or higher-risk controls, so a benchmarking or access review control with judgment in it usually needs more. Check each roll-forward file for the risk rating that justified inquiry, and confirm that a reviewer signed off on that rating. If the rating is missing or was set after the testing, expect the gap to be cited.
Roll-forward skipped after interim exceptions
When interim testing found an exception, the control cannot be rolled forward on the strength of a clean sample alone. Under AS 2201, the interim results are one of the factors that set how much roll-forward evidence is needed, and an exception raises that bar. Pull every interim exception and confirm that a documented follow-up exists, covering root cause, remediation and any retest. A roll-forward file that closes the control without addressing the exception is a common citation.
Changes after the interim date ignored
Roll-forward has to account for significant changes in internal control between the interim date and year end. For ITGCs, that means system upgrades, configuration changes, emergency fixes, new administrators, role redesigns and access reviews that moved people between roles. Compare the change management log, the privileged access list and the ticketing history against the interim date. Each change that touches a financially significant system should map to a roll-forward step or a documented reason it does not matter.
Long gap left to inquiry
The longer the period between the interim test and fiscal year end, the more evidence the auditor expects. Alert No. 11 names a roll-forward period that spans a significant part of the year as a reason inquiry alone is unlikely to suffice. Calculate the gap in days for each tested control and flag any control where the remaining period is large relative to the year. For those controls, check whether the team tested additional periods or sampled later dates instead of relying on a single interim test.
Monitoring evidence treated as sufficient
SEC guidance allows management to rely on ongoing monitoring only when ICFR risk is low, and the evaluation should still consider evidence from a reasonable period, including fiscal year end. Teams sometimes cite a monthly review meeting as proof that a control worked through December. Check that the monitoring evidence covers the actual roll-forward window, that the reviewer was independent of the control owner, and that the review was precise enough to catch the kind of failure the control prevents.
Who owns the roll-forward and who prepares the evidence
Management owns the roll-forward. The controls belong to the company, and so does the conclusion. Management's annual assessment under Section 404(a) of the Sarbanes-Oxley Act is made as of fiscal year end, so the people who run the change management, access review and job monitoring processes must be able to show that those controls still worked after the interim test date. Management decides how much roll-forward evidence is enough for each ITGC, based on the factors in PCAOB AS 2201, and it signs off on that judgment. An implementation partner can prepare the material, but it cannot take over the decision.
An implementation partner such as DeployOpen can prepare the records that roll-forward testing depends on. For the period between the interim test date and fiscal year end, that typically means system change logs with approvals and test sign-offs, privileged access and user access review records, job scheduling and failure reports, and a dated evidence pack that maps each item to the control it supports. Confirm with the partner which of these come directly from your systems and which must be exported, screenshotted or reconciled by hand, and who keeps the original files. The partner prepares and organizes this evidence. It does not perform the independent assessment and it does not issue an attestation.
Only the independent registered public accounting firm issues the attestation report under AS 2201, and only for companies where the auditor attestation applies. Evaluators who test the controls should be independent of the people who operate them. SEC Release 33-8810 explains that the objectivity of the people providing evidence affects how much weight management can place on it, so a control owner reviewing their own changes is weaker support than a separate reviewer. Before work starts, agree in writing who will perform each roll-forward procedure, who reviews the results, and who the auditor will ask for.
What to have in place before the roll-forward starts
Roll-forward is only as strong as the records it starts from. The items below are the inputs an assessor will ask for first, and each one can be checked before fieldwork begins. Together they show what changed since the interim test and whether the controls still work the way they did at the interim date.
Documented interim population
Keep a dated list of every change, access grant, job run and ticket that fell inside the interim test window, along with the population the sample was drawn from. Roll-forward begins where that population ends, so the gap between the two dates must be traceable. Check that the population was complete when extracted by reconciling its record count to the source system. A population that cannot be reproduced later weakens every roll-forward sample built on it.
Change log for the roll-forward period
Pull every change to financially significant applications, configurations and infrastructure made after the interim cutoff through year end. Each entry should show the request, approver, tester and production release date. Compare the log to the change management system's own records to confirm nothing was deployed outside the workflow. Gaps in this log are among the most common reasons roll-forward testing is extended.
Current access listings
Generate fresh user listings for each in-scope application, database and operating system layer, along with privileged and service account lists. Ask the system owner to confirm that each account and role still matches a current job duty. Compare the listing to the HR termination feed for the period to find leavers who kept access. Date-stamp every extract, because an undated listing cannot support a year-end conclusion.
Retained monitoring and review evidence
Collect the signed access reviews, job failure reports, backup logs and incident tickets produced during the roll-forward period. Confirm each review shows who performed it, what was compared, what exceptions were found and how they were resolved. Ongoing monitoring counts as evidence only when it is recurring, retained and performed by someone independent of the control. Check that reviewers' sign-offs are present for every period, not only the months before interim testing.
Control changes since the interim date
Maintain a written list of anything that altered an ITGC or the systems it covers after the interim test: new releases, role redesigns, reorganized teams, new hosting or a change in provider. Each item should note whether it changed control design, operation or only the environment. Auditors use this list to decide whether inquiry is enough or whether samples must be taken again. A short, accurate list is easier to defend than a long one written after the fact.
A named owner for each ITGC
Assign one accountable person to each ITGC area, covering access, program changes, program development and computer operations, and record who backs them up. The owner answers the auditor's questions, confirms that evidence is complete and signs off on the roll-forward workpapers. Confirm the owner has the authority to fix a gap before year end and is not also the sole tester of that control. Unclear ownership is a frequent source of late requests and missed evidence.
Questions teams ask about ITGC roll-forward testing
How much effort does an ITGC roll-forward usually take?
Effort depends mostly on how far the roll-forward period runs and how many controls were tested at the interim date. No supplied source gives a typical number of hours or days, so ask your auditor for its expected sample sizes and roll-forward procedures before you plan. The main drivers are the length of the remaining period, the number of in-scope applications and ITGC areas, whether any change occurred after interim testing, and whether the control is automated or depends on manual review. Under PCAOB AS 2201, the evidence needed depends on the control's risk and nature, the interim results, the length of the remaining period and any significant changes in ICFR. Ask any provider for a written scope listing the controls, systems, periods and evidence types it will cover, along with who performs each step.
Can inquiry alone carry an ITGC roll-forward?
Sometimes, but only when the risk of the control failing after interim testing is low. A note to PCAOB AS 2201 says inquiry alone might be a sufficient roll-forward procedure only in that case. Staff Audit Practice Alert No. 11 says inquiry is unlikely to be enough when a control is complex, subjective or higher risk, when interim testing found exceptions, when the roll-forward period spans a significant part of the year, or when internal control changed. For most access and change controls with a meaningful remaining period, expect to see system-generated reports, samples of approvals or review sign-offs dated after the interim date. Inquiry is a question you answer with evidence, not a substitute for it.
What changes after a system upgrade during the year?
An upgrade usually changes the risk assessment, which can require new testing rather than a simple roll-forward. Under AS 2201, significant changes in ICFR are one of the factors that set the evidence needed, and Staff Audit Practice Alert No. 11 lists a change in internal control as a reason inquiry alone is unlikely to be enough. Expect the auditor to ask for the change ticket, the testing and approval record, the migration or go-live approval, and evidence that access and change controls still operate on the new version. If the upgrade touched configuration that drives automated calculations, the control may need to be tested again on the changed system. Confirm early with your auditor how it classifies the change and what evidence it expects.
Can internal staff perform the roll-forward themselves?
Internal staff can perform roll-forward work when they are competent and independent of the controls they test. Management must keep evidential matter for its own assessment, and the external auditor decides how much of that work it can rely on. The objectivity question matters most: a system administrator who operates a control should not be the only person who tests whether it still works. A co-sourced internal audit team or an outside consultant can prepare the population, samples and evidence, but management still owns the conclusion and the control. Ask your auditor in advance which roll-forward steps it will accept from internal staff and what documentation it will want to see.
What does the external auditor need from management for roll-forward?
The auditor needs a clear, dated trail showing what changed after interim testing and what evidence supports the controls through year end. In practice, that means a current list of in-scope systems and controls, change history for the period, access and user listings as of year end, samples of operating evidence dated after the interim date, and a record of any exceptions and their remediation. Management should also explain its risk assessment for each control and why the roll-forward evidence is sufficient for that risk. Evidence that cannot be reperformed or that lacks a date and owner is usually rejected. Agree the list of required items with the auditor before the roll-forward period starts so that gaps surface early.
How do exceptions found at interim testing change the work?
An exception at interim testing usually expands the roll-forward and can make inquiry insufficient. Staff Audit Practice Alert No. 11 names exceptions found during interim testing as a reason inquiry alone is unlikely to roll forward a control. The response typically includes understanding the root cause, determining whether the exception affects other controls or systems, testing remediation, and extending the sample or the period to cover the fix. If the exception points to a deficiency that could lead to a material misstatement, it may escalate into a formal evaluation of severity and disclosure. Treat interim exceptions as a planning input for year-end testing rather than a closed item once a fix is deployed.
Which roll-forward gaps do PCAOB inspections cite most?
This page does not have a researched list of the inspection findings PCAOB cites most often, so confirm current inspection themes with your auditor and in the latest PCAOB inspection reports. The general principle from AS 2201 is that testing over a longer period and closer to the assessment date gives more evidence, so gaps usually appear where a control was tested early and little evidence was gathered for the remaining period. Ask your auditor to walk you through the roll-forward procedures it applies to automated controls, user access reviews and change management, and compare them with the evidence your team already holds.
When to bring in an outside partner for ITGC evidence
Bring in an outside partner when the internal team cannot produce roll-forward evidence on time, not simply when the workload feels large. The usual triggers are limited internal capacity to re-perform or document tests after the interim date, a large number of applications, databases and infrastructure components in scope, a first-year assessment where no prior evidence set exists, or an interim finding late enough that the remaining period leaves little time to remediate and re-test. Each of these makes the roll-forward window tighter, and the factors in AS 2201 paragraphs 55 and 56 (control risk, interim results, length of the remaining period and significant changes) are harder to satisfy when the people who gather evidence are stretched.
DeployOpen is a Chainscore Labs company. It prepares systems and evidence inside the client's own cloud accounts, data centers or air-gapped networks, for example by organizing access review exports, change tickets, job logs and configuration snapshots for the roll-forward period. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen does not issue audit reports or attestations, does not decide whether a control is effective, and cannot guarantee how an auditor or management will conclude. Management still owns its controls and its 404(a) assessment, and the external auditor decides what it will rely on.
Before scoping any outside work, ask the external auditor in writing which roll-forward evidence it will accept for each ITGC, whether it will accept inquiry alone for any control, and whether it will rely on internal audit or a co-sourced team for testing. Ask the same question about population completeness and system-generated reports. Those answers define the deliverables, so an engagement written without them risks producing evidence the auditor does not use. Confirm the auditor's expectations against the staff guidance and the SEC release linked on this page, and treat any partner who promises a clean opinion or a particular audit outcome as a reason to slow down.
