{"description":"Runs on the existing SOX Audit using approved interim results and remaining-period commitments. Produces independently reviewed year-end coverage, a separate Year-end Management Inquiry Package and the full-year conclusion for audit reporting and deficiency aggregation.","edges":[{"id":"e-changes-management-year-end-inquiries","source":"changes","target":"management-year-end-inquiries"},{"id":"e-management-year-end-inquiries-roll-conclusion","source":"management-year-end-inquiries","target":"roll-conclusion"}],"isPublic":true,"itemTypeSlug":"audit","metadata":{"capabilities":[],"controlVerbs":{"UC-AUDIT-21":"tests","UC-AUDIT-25":"operates"},"controls":["UC-AUDIT-21","UC-AUDIT-25"],"department":"internal-audit","domains":["sox"],"library":{"aliases":[],"canonicalUrl":"https://workflow-library.com/all/?w=sox-period-end-roll-forward-testing","contentDigest":"sha256:4d21a6f09c45e2990d073d8fbadc984b694d6579c9740ac5880b6ef21da577d2","prerequisites":{"status":"undeclared"},"provenance":[],"releaseId":"sha256:4d21a6f09c45e2990d073d8fbadc984b694d6579c9740ac5880b6ef21da577d2","schemaVersion":1,"sourceTemplateId":"workflow-library:sox-period-end-roll-forward-testing"},"lifecycleContract":{"absorbedNodeIds":{"remaining-period":"changes","residual-exceptions":"roll-conclusion","test":"roll-conclusion"},"approvalPolicy":"Independent reviewers cannot be the preparer, tester or control owner for the reviewed work. Required approval counts alone do not establish actor independence; verify assignments and exact versions at execution.","bindingRequirements":["Resolve named human roles to actual users and configure native step approvals before execution.","Workstream and Narrative Module are tenant communication/document destinations; verify a supported connector or record manual dispatch by the authorized sender.","EY is the tenant-bound external auditor; preserve its independent methodology and reliance judgments."],"bindingStatus":"requires-tenant-configuration","checkpoints":[{"contribution":"Judge changed-control and remaining-period coverage, including year-end-only occurrences.","interventions":["expertise"],"nodeId":"changes","requiredApprovals":1,"role":"IA/SOX year-end testing lead"},{"contribution":"Approve full-year coverage and inquiry impact with residual limitations visible.","interventions":["expertise","approval"],"nodeId":"roll-conclusion","requiredApprovals":1,"role":"Independent year-end reviewer"},{"contribution":"Challenge management answers against evidence and assess unresolved year-end facts.","interventions":["expertise"],"nodeId":"management-year-end-inquiries","requiredApprovals":1,"role":"IA inquiry reviewer"}],"version":1},"lineOfDefense":"assure","mappingStatus":"mapped","risks":[],"slug":"sox-period-end-roll-forward-testing","source":"coworkcanvas-gallery","standards":["coso-ic","iso-27001","nist-800-53","soc2","sox"],"teams":["internal-audit","finance"]},"name":"Period-End Roll-Forward Testing","nodes":[{"data":{"instructions":"**Objective** — Produce the reviewed outcome for evaluate control changes within the authorized scope.\n\n**Human contribution** — IA/SOX year-end testing lead (expertise): Judge changed-control and remaining-period coverage, including year-end-only occurrences. Assign the named role to this step’s native approval before execution; the executor cannot satisfy an independent review role. Record the reviewed version and decision in the native approval and step result.\n\n**Inputs**\nThe linked request or system record, the approved procedure and configuration, and the reviewed outputs of prerequisite steps. Resolve the named operating and approving roles before execution.\n\n**Procedure**\n1. Consume sox-interim-operating-effectiveness-testing/coordinate-interim-results: approved interim conclusions, reliance decisions, control changes, exceptions and remaining-period commitments. Reconcile the interval from the interim cutoff through year-end with annual and nonroutine control occurrences; identify year-end-only testing and remediation retests.\n2. Issue the year-end owner PBC batch through sox-key-control-tod-toe-test/roll-forward-pbc-request-list, explicitly marked year-end with the requested period, named control owners, evidence due dates and tenant-bound Workstream destination. Keep incoming external-auditor requests separate.\n3. For changed or redesigned controls, obtain fresh independent TOD approval for the new version before testing it. Preserve prior and current versions and their respective effective dates.\n\n*Agent preparation and filing absorb “Define Remaining Period”; the role named below owns the substantive review.*\nIdentify the period since interim testing, the remaining population, key dates, and changes in systems, ownership, or control design.\n\nAssess changes for impact on the interim conclusion and document whether the sampling approach or test attributes must change.\n\n**Record in AssureSwarm**\nRecord the actions and evidence examined, their actual dates and source references, the responsible role, the human decision and unresolved exceptions in this step's result. Attach or link the evidence using the supported record and review path. Never record credentials or secret values.\n\n**Exit criteria** — The reviewed plan covers the interim cutoff through year-end, year-end-only occurrences and changed control versions; owner requests have issued batch references or explicit pending status, and every remaining-period task has an owner and date.","kind":"task","label":"Evaluate Control Changes","requiredApprovals":1},"id":"changes"},{"data":{"instructions":"**Objective** — Approve full-year control coverage and the effect of management inquiries using the independently approved Control test results.\n\n**Human contribution** — Independent year-end reviewer (expertise, approval): Judge whether interim and remaining-period evidence supports the full-year conclusion, including changed controls, inquiry findings and residual limitations. Assign a reviewer independent of the testing to native approval; record the exact package version and decision.\n\n**Inputs**\n- The reviewed changed-control and remaining-period plan at changes, including year-end-only occurrences and post-remediation retests.\n- Published detailed results and workpapers at sox-key-control-tod-toe-test/execute-attribute-testing, with the exact control version, fiscal year and year-end test period; independent native approvals at sox-key-control-tod-toe-test/reviewer-sign-off.\n- The reviewed Year-end Management Inquiry Package at management-year-end-inquiries, including response evidence, contradictions and unanswered questions.\n- Approved interim conclusions, residual exceptions, remediation status and compensating-control evidence from the linked SOX Audit and Control test instances.\n\n**Procedure**\n*Agent preparation absorbs “Test Remaining-Period Operation” and “Document Residual Exceptions and Period-End Conclusion”; detailed testing and its approvals remain on the Control producer.*\n1. Track completion of the Control-hosted sampling, IPE validation, attribute testing and independent review for remaining-period, year-end-only and post-remediation occurrences in the plan at changes. Link the exact result documents and approval records; return missing or unsupported packages to their producing Control workflow. Management inquiries proceed alongside this detailed work and do not wait for a second testing checkpoint in this coordinator.\n2. Reconcile interim and remaining-period dates, control versions, year-end-only occurrences and remediation retests to the full in-scope control population. Identify uncovered periods, incomplete controls and changes that invalidate reliance on an earlier version. Preserve the source conclusions; this checkpoint does not sample, retest attributes or reapprove individual control tests.\n3. Evaluate the reviewed inquiry findings against that coverage: explain contradictions, subsequent changes, missing responses and their effect on the full-year conclusion. Record residual exceptions, remediation status and evidenced compensating controls without treating a completed test as closure of an open deficiency.\n4. Require an independent reviewer, neither tester nor control owner, to approve the exact full-year coverage/inquiry package through native approval. Missing detailed approvals, unresolved review notes or unassessed inquiry responses block sign-off. Any accepted limitation must remain explicit in the conclusion.\n5. Hand the approved package to audit-report-drafting and sox-deficiency-aggregation-evaluation, with the coverage reconciliation, source approval links, inquiry assessment and remaining limitations.\n\n**Record in AssureSwarm** — Attach the full-year coverage reconciliation and conclusion to roll-conclusion. Record source Control instance IDs, exact result/approval versions, inquiry references, residual exceptions and limitations in this step's result; capture the independent full-year decision through native approval. Detailed test results remain on their producing Control steps.\n\n**Exit criteria** — The independent native approval identifies the exact full-year package; interim and remaining-period coverage reconcile, detailed test approvals and evaluated inquiry responses are linked, and residual exceptions and period gaps remain explicit.","kind":"task","label":"Roll Conclusion to Period End","requiredApprovals":1},"id":"roll-conclusion"},{"data":{"instructions":"**Objective** — Resolve management facts affecting the year-end ICFR conclusion.\n\n**Human contribution** — IA inquiry reviewer (expertise): Challenge management answers against evidence and assess unresolved year-end facts. Assign the named role to this step’s native approval before execution; the executor cannot satisfy an independent review role. Record the reviewed version and decision in the native approval and step result.\n\n**Inputs** — Approved annual scope, interim issues and remaining-period plan, known business/control changes, and the tenant-approved year-end inquiry procedures.\n\n**Procedure**\n1. Prepare a distinct Year-end Management Inquiry Package for named business/process owners, the Controller and functional leads responsible for the facts. Reuse facts already evidenced; ask only unresolved questions about changes to controls or personnel, unreported failures, fraud allegations, unusual transactions, subsequent events and outstanding corrective actions affecting the defined period.\n2. Record each question, why existing evidence is insufficient, intended respondent, relevant control/process, year-end cutoff, response deadline and supporting evidence requested. Obtain IA methodology review of the package before dispatch; this inquiry package remains separate from the management assertion or certification.\n3. Submit the approved inquiry procedures through the tenant-bound Workstream channel under recorded outreach authority. Record the exact version, recipients, actual dispatch, receipt and response dates; track nonresponses and overdue follow-up. A pending sender or destination is an unresolved dependency.\n4. Evaluate each management answer against test results, change logs and source documents. Resolve contradictions with the respondent, document unanswered questions and assess their effect on control coverage, exceptions and the year-end conclusion. Attach the response/evidence matrix and escalate material uncertainty to IA management.\n\n**Record in AssureSwarm** — Put the analysis, exact document version, evidence references, recipients, actual dates, open questions and owners in this step's result. Attach the package and received evidence as step documents. Capture sign-off through native approval.\n\n**Exit criteria** — The IA reviewer accepts the evidence-backed inquiry assessment; all responses or unresolved limitations are explicit and the conclusion cannot imply that missing answers were received.","kind":"task","label":"Review management year-end inquiries","requiredApprovals":1},"id":"management-year-end-inquiries"}],"sourceTemplateId":"workflow-library:sox-period-end-roll-forward-testing"}