Internal Controls Documentation Template
Four documents and three sheets, with a control code on the exact step it protects and carried unchanged into the register and the test log.
Free download · No account needed
Process Narrative — [Cycle]
[Company] — the control sits on the step, not beside it
Every step is numbered from the start point to the end point before any control is attached to one of them.
| Step | What happens | Control |
|---|---|---|
| 1 | [Step description] | — |
| 2 | [Step description] | C-1 preventive |
| 3 | [Step description] | — |
| 4 | [Step description] | C-2 detective |
Same code, same meaning, everywhere it appears
| Narrative | Step 2, written on the line |
| Flow diagram | Step 2, same code on the line |
| Controls Register | C-1, [cycle], step 2 |
| Test Log | Population, sample, result |
A control with no step number is unfinished, not optional. A step with no control is correct, not a gap.
Search "internal controls documentation template" and the results split into audit exam explainers and one fill-in format, and all of them treat the narrative and the flow diagram as two documents to keep in sync by hand. One guide even states that a control appearing in the narrative should also appear on the flowchart, and vice versa, a task rather than something the file enforces on its own. A standalone control description can be complete, an ID, an assertion, a frequency, and still carry no step number to attach it to.
Castellan Filtration, Inc., an illustrative filtration equipment manufacturer with 28.4 million in fiscal 2026 revenue, numbers order to cash, procure to pay and close into 21 steps across three narratives. Sixteen controls attach to the steps that carry real risk, five, six and five per cycle. Each narrative closes with a flow diagram carrying the same codes on the same lines, so the two agree by construction, not by a later cross-check. PCAOB AS 2201 requires understanding how transactions are initiated, authorized, processed and recorded, and identifying where a misstatement could arise first.
Seven of the sixteen controls are key and get tested every year, seventy-four sample items sized from how often each one runs, and this year's testing found two exceptions. One invoice cleared the Procure to Pay match hold with no logged override, 18,400 dollars, a control deficiency. One vendor banking change skipped its callback, and the 61,300 dollars paid afterward is a significant deficiency, since that callback is the only control against a redirected payment. 15 U.S.C. 7262 is why severity matters: management assesses it every year, naming its framework under 17 CFR 229.308.
What's in the pack
Process Narratives, one per cycle
Order to cash, procure to pay and close, each numbered from its start point to its end point, with a flow diagram carrying the same control codes as the text, ready for the audit preparation request list.
Controls Matrix Notes
How to read the three sheets behind it: the ID convention, preventive versus detective, the assertion each control addresses, how a sample size gets set, and how severity gets decided.
Controls Register sheet
All sixteen controls from all three cycles in one place: cycle, step, description, type, frequency, assertion, owner, and whether it is key.
Test Log sheet
Population, sample size, and the result for every control actually tested this year, passing or not, so a passed control and an untested one are never mistaken for each other.
Deficiency Tracker sheet
Every exception the Test Log turned up, with a severity, a written reason for that severity, and what future exposure looks like if the gap stays open. Once the auditor writes it into a management letter, the remediation plan pack is where it gets a named owner and a target date.
Space rule: the control sits on the step
A control ID means the numbered step in a cycle's narrative where it stands, never a category held apart from the sequence it protects.
Space rule: severity gets a written reason
No deficiency gets filed with a severity and no reason next to it, so the judgment call is visible before the year end close statements are finalized.
How to use it
- 1
Open in River, or download it
Download the blank pack as Word and CSV files with no account, or open it in River and send a real walkthrough of one cycle.
- 2
Send one cycle's walkthrough
A recording, notes from sitting with the person who runs it, or a plain description of the steps in order, for order to cash, procure to pay, or close.
- 3
Steps get numbered, then controls get placed
The sequence is confirmed first; a control is attached only to the specific step where a misstatement could actually arise, and the flow diagram is drawn with its code on that line.
- 4
Build the register, size the sample, log the result
Controls roll into one register across all three cycles, each key control's sample is sized from how often it runs, and the tie-out this narrative documents becomes what the lead schedule set pack turns into schedules.
Frequently asked questions
Is this template free?
Yes. Four documents and three sheets download as Word and CSV with no account, no card, and no trial. Edit with AI is the optional path for sending a real walkthrough instead of retyping three cycles into this format by hand. The rest of the library is at free templates.
How is this different from a flowchart plus a separate controls list?
Most guides keep them as two files a preparer has to keep consistent by hand, one even says the same control should appear on both. Here the flow diagram is drawn from the numbered narrative itself, so a control's code sits on the same line in both places and the two cannot quietly drift apart the way two separate files can.
How do you size the sample for testing a control?
From how often the control actually ran in the period, not a flat number. A control tested daily draws a larger sample than one that runs monthly, and a control that only fires a handful of times a year, like a vendor banking change, gets tested in full instead of sampled. Castellan's seven key controls tested 74 items this way.
What makes a deficiency significant rather than just a control deficiency?
Whether there is a reasonable possibility the control could fail again and how large the resulting misstatement could get, not the dollar figure this instance happened to involve. PCAOB AS 2201 ties severity to that possibility and its potential size. In the worked example, the smaller dollar exception is the more severe finding, because nothing else in the cycle would have caught it.
Does this replace a SOC 1 report or a formal SOX assessment?
No. 15 U.S.C. 7262 requires a public company's management to assess internal control effectiveness every year, and a SOC 1 is a service organization's own attestation. This pack produces the narratives, register, and test evidence either one gets built from. It documents the process; it does not issue an opinion on it.
How is this different from the segregation of duties review?
They test different things. Segregation of duties reads a permission export and flags who can both create and approve the same transaction. This pack documents the process itself, step by step, and shows exactly where a control sits inside it, which is where a duties conflict actually becomes exploitable in the first place.
Put every control on the step it actually protects
Download the blank pack as Word and CSV files, or open this exact pack in River and send a real walkthrough of one cycle to start.
Edit with AI