Internal Audit · ENG-102
Q3 FY26 SOX Testing — ITGC
Test ITGCs supporting in-scope automated controls across NetSuite, Salesforce CPQ and Azure.
Phase
Review
88% complete
Hours
742
of 860 planned
AI / human split
654 / 88
Hours executed
Open issues
2
At risk
Engagement facts
- Type
- SOX
- Audit Manager Agent
- Morgan
- Dates
- Aug 4 – Sep 26
- Status
- At risk
- Progress
- 88%
Manager agent view
Morgan · Audit Manager Agent
Review is the constraint: 2 workpapers carry open review notes and the September termination report is outstanding. Recommend releasing the ITGC conclusion once EV-2049 arrives, or extending the end date by one week.
Audit program
Objective + risk + scope + methodology, translated into procedures
| Step | Procedure | Control | Agent | Evidence | Reviewer | Status |
|---|---|---|---|---|---|---|
| P-01 | Understand the credit memo process and confirm the FY26 workflow change | R2C-014 | Kai | Walkthrough WT-116 | Dev | Complete |
| P-02 | Obtain and validate the population of credit memos over $25K | R2C-014 | Tessa | EV-2041 | Dev | Complete |
| P-03 | Select a sample of 45 items using methodology §7.3 | R2C-014 | Tessa | Sampling memo | Dev | Complete |
| P-04 | Test each sample for the five approval attributes | R2C-014 | Tessa | WP R2C-014 | Dev | In progress |
| P-05 | Perform full-population analytic on returns-queue memos | R2C-014 | Nova | Analytic AN-77 | Morgan | In progress |
| P-06 | Evaluate exception severity and compensating controls | R2C-014 | Morgan | Deficiency memo DE-31 | Human — SOX Director | Review |
| P-07 | Test the monthly revenue analytic review for three months | FCR-003 | Tessa | WP FCR-003 | Dev | Complete |
| P-08 | Validate the aged AR key report used in the reserve estimate | IPE-005 | Tessa | WP IPE-005 | Dev | Review |
| P-09 | Independent QA review of the Order to Cash workpaper set | All | Juno | QA checklist | Human — CAE | In progress |
Workpapers
3 in this engagement
| Workpaper | Preparer | Reviewer | Notes | Exceptions | Status |
|---|---|---|---|---|---|
NetSuite privileged access review WP-ITGC-004 | Rowan | Dev | 1 | 2 | In review |
Change management testing WP-ITGC-009 | Rowan | Dev | 0 | 0 | Prepared |
Terminated user access testing WP-ITGC-017 | Rowan | Dev | 0 | 3 | QA complete |
Issues raised
2 findings
| Finding | Rating | Owner | Due | Status |
|---|---|---|---|---|
Terminated user access not removed within standard F-2071 | Medium | IT Operations Lead | Nov 30, FY26 | Awaiting approval |
Segregation of duties conflicts without mitigating controls F-2068 | High | CIO | Jan 31, FY27 | Issued |
Recent agent activity
| Task | Agent | State | Progress | Updated |
|---|