Control Design Document Template
Template for documenting control design including objectives, attributes, and testing approach.
Control Design Document Template
Control Documentation
Control Identification
| Field | Information | |-------|-------------| | Control ID | CTRL-[Category]-[###] | | Control Name | | | Control Owner | | | Effective Date | | | Last Updated | | | Version | |
Control Classification
Control Type: ☐ Preventive ☐ Detective ☐ Corrective
Control Nature: ☐ Manual ☐ Automated ☐ IT-Dependent Manual
Control Frequency: ☐ Continuous ☐ Daily ☐ Weekly ☐ Monthly ☐ Quarterly ☐ Annually ☐ Ad-hoc
Key Control: ☐ Yes ☐ No
Risk and Objective
Associated Risk(s): | Risk ID | Risk Description | |---------|------------------| | | | | | |
Control Objective: [What the control is designed to achieve]
Relevant Assertion(s): ☐ Completeness ☐ Accuracy ☐ Authorization ☐ Validity ☐ Existence ☐ Valuation ☐ Rights/Obligations ☐ Presentation
Control Description
Control Narrative: [Detailed description of what is done, by whom, when, and how]
Control Attributes: | Attribute | Description | |-----------|-------------| | Who | [Role/person performing control] | | What | [Specific action taken] | | When | [Timing/frequency] | | How | [Method/tools used] | | Evidence | [Documentation produced] |
Inputs and Outputs
Inputs: | Input | Source | |-------|--------| | | | | | |
Outputs/Evidence: | Output | Retention | |--------|-----------| | | | | | |
IPE (Information Produced by Entity)
System-Generated Reports Used: | Report | System | Completeness/Accuracy Controls | |--------|--------|-------------------------------| | | | |
Dependencies
Upstream Controls: | Control ID | Description | |------------|-------------| | | |
IT General Controls: | Control Area | Relevant? | |--------------|-----------| | Access Security | ☐ Yes ☐ No | | Change Management | ☐ Yes ☐ No | | Computer Operations | ☐ Yes ☐ No |
Testing Approach
Design Test: | Test Step | Procedure | |-----------|-----------| | 1 | Inquire of control owner regarding process | | 2 | Obtain and inspect control documentation | | 3 | Walk through one transaction | | 4 | Assess design effectiveness |
Operating Effectiveness Test: | Test Step | Procedure | |-----------|-----------| | 1 | Select sample per methodology | | 2 | Obtain evidence for each sample | | 3 | Verify [specific attributes] | | 4 | Document exceptions | | 5 | Conclude on effectiveness |
Sample Size: Based on [frequency], sample of [N] items
Exception Handling
Potential Exceptions:
- [Type of exception that could occur]
- [Type of exception that could occur]
Escalation: Exceptions are escalated to [role] within [timeframe]
Approval
| Role | Name | Date | |------|------|------| | Control Owner | | | | Risk Manager | | | | Process Owner | | |