River
Y CombinatorBacked by Y Combinator
FREE TEMPLATE

Internal Controls Documentation Template

Four documents and three sheets, with a control code on the exact step it protects and carried unchanged into the register and the test log.

Free download  ·  No account needed

Process Narrative — [Cycle]

[Company] — the control sits on the step, not beside it

Every step is numbered from the start point to the end point before any control is attached to one of them.

StepWhat happensControl
1[Step description]
2[Step description]C-1 preventive
3[Step description]
4[Step description]C-2 detective

Same code, same meaning, everywhere it appears

NarrativeStep 2, written on the line
Flow diagramStep 2, same code on the line
Controls RegisterC-1, [cycle], step 2
Test LogPopulation, sample, result

A control with no step number is unfinished, not optional. A step with no control is correct, not a gap.

Search "internal controls documentation template" and the results split into audit exam explainers and one fill-in format, and all of them treat the narrative and the flow diagram as two documents to keep in sync by hand. One guide even states that a control appearing in the narrative should also appear on the flowchart, and vice versa, a task rather than something the file enforces on its own. A standalone control description can be complete, an ID, an assertion, a frequency, and still carry no step number to attach it to.

Castellan Filtration, Inc., an illustrative filtration equipment manufacturer with 28.4 million in fiscal 2026 revenue, numbers order to cash, procure to pay and close into 21 steps across three narratives. Sixteen controls attach to the steps that carry real risk, five, six and five per cycle. Each narrative closes with a flow diagram carrying the same codes on the same lines, so the two agree by construction, not by a later cross-check. PCAOB AS 2201 requires understanding how transactions are initiated, authorized, processed and recorded, and identifying where a misstatement could arise first.

Seven of the sixteen controls are key and get tested every year, seventy-four sample items sized from how often each one runs, and this year's testing found two exceptions. One invoice cleared the Procure to Pay match hold with no logged override, 18,400 dollars, a control deficiency. One vendor banking change skipped its callback, and the 61,300 dollars paid afterward is a significant deficiency, since that callback is the only control against a redirected payment. 15 U.S.C. 7262 is why severity matters: management assesses it every year, naming its framework under 17 CFR 229.308.

Three cycles, one register, and the two exceptions testing actually found

Order to Cash, Procure to Pay, Close, the Controls Register, the Test Log, and the Deficiency Tracker.

Process Narrative: Order to Cash

Castellan Filtration, Inc., an illustrative filtration equipment manufacturer. FY2026, 8 steps, 5 controls.

StepWhat happensOwnerControl
1Customer order received, logged against the accountSales
2Credit check against the limit on fileCreditC-1 preventive
3Sales order created in the ERPSales
4Warehouse picks and ships, matched to the orderWarehouseC-2 preventive
5Invoice generated, price and quantity matchedBillingC-3 preventive
6Invoice sent to the customer, revenue recordedBilling
7Cash received, applied against the remittance adviceARC-4 detective
8AR aging reviewed, past-due balances followed upControllerC-5 detective

C-2 and C-5 are this cycle's key controls, tested below. Cash applied at step 7 and the aging reviewed at step 8 both feed the subledger tie-out that opens the Close cycle.

Process Narrative: Procure to Pay

Same company. FY2026, 7 steps, 6 controls.

StepWhat happensOwnerControl
1Purchase requisition raisedRequesterC-6 preventive
2Purchase order issued to an approved vendorPurchasing
3Goods received, receipt logged and matched to the POReceivingC-7 preventive
4Vendor invoice received, held pending the 3-way matchAPC-8 preventive
5Invoice coded to the GL, reviewed by a second preparerAPC-9 preventive
6Payment run prepared and released, second approvalTreasuryC-10 preventive
7Vendor master maintained; banking changes verifiedAPC-11 preventive

C-8, C-10 and C-11 are this cycle's key controls. C-11 is the only control in either cycle built against a payment redirected to an altered bank account.

Process Narrative: Close

Same company. FY2026, 6 steps, 5 controls.

StepWhat happensOwnerControl
1Subledgers closed, tied to the general ledgerControllerC-12 detective
2Standard and recurring journal entries postedStaff acct.
3Manual entries posted, reviewed above the thresholdStaff acct.C-13 preventive
4Key account reconciliations prepared, reviewed, signed offControllerC-14 detective
5Flux and variance analysis performed, variances explainedControllerC-15 detective
6Statements and disclosures drafted, reviewedCFOC-16 detective

C-14 and C-16 are this cycle's key controls. Step 1's subledger tie-out is where the AR balance from Order to Cash and the AP balance from Procure to Pay both have to land before this cycle's own controls start.

Controls Register

All sixteen controls from all three cycles. Seven marked key get tested every year; the other nine carry a redundancy note instead (full text in the pack).

IDCycleStepTypeKey
C-1O2C2Preventive
C-2O2C4PreventiveY
C-3O2C5Preventive
C-4O2C7Detective
C-5O2C8DetectiveY
C-6P2P1Preventive
C-7P2P3Preventive
C-8P2P4PreventiveY
C-9P2P5Preventive
C-10P2P6PreventiveY
C-11P2P7PreventiveY
C-12Close1Detective
C-13Close3Preventive
C-14Close4DetectiveY
C-15Close5Detective
C-16Close6DetectiveY
16 controls3 cycles21 steps10 prev. / 6 det.7 key

Key means no other control in the cycle would catch the same failure. Non-key controls stay on the register and in the narrative; they are documented, just not sampled every period.

Test Log

The seven key controls, tested for FY2026. Population is how many times the control actually ran; sample is scaled to that, not a flat number.

IDCycleFrequencyPop.SampleExc.DeviationResult
C-2O2CDaily2502500.0%Operating effectively
C-5O2CMonthly12300.0%Operating effectively
C-8P2PDaily2502514.0%Exception, see DEF-1
C-10P2PWeekly52800.0%Operating effectively
C-11P2PAs-triggered77114.3%Exception, see DEF-2
C-14CloseMonthly12300.0%Operating effectively
C-16CloseMonthly12300.0%Operating effectively
Total5957422.7%

C-11's population is only seven because it only runs when a vendor's banking details actually change; testing all seven rather than sampling is the point, not a shortcut.

Deficiency Tracker

The two exceptions the Test Log found, each carried through to a severity and a written reason for it.

DEF-1 — C-8, match-hold override

Amount, this instance$18,400
Sample deviation1 of 25 (4.0%)
SeverityControl deficiency

Invoice released and paid from hold before its receipt leg cleared, six points over the 2 percent tolerance, with no logged approval for the override. Isolated to one instance, and C-8 resumes automatically on the next invoice with nothing carried forward.

DEF-2 — C-11, unlogged callback

Amount, this instance$61,300
Sample deviation1 of 7 (14.3%)
SeveritySignificant deficiency

One of seven vendor banking-detail changes took effect with no callback logged; the change was later confirmed legitimate. Severity is higher than C-8's anyway: this is the sole control against a redirected payment, and the exposure is every future payment to this vendor, not only the $61,300 already paid.

Neither exception, alone or together, was assessed as a material weakness for FY2026. That call is about this year's facts, not a rule that a callback gap can never rise to one.

What's in the pack

01

Process Narratives, one per cycle

Order to cash, procure to pay and close, each numbered from its start point to its end point, with a flow diagram carrying the same control codes as the text, ready for the audit preparation request list.

02

Controls Matrix Notes

How to read the three sheets behind it: the ID convention, preventive versus detective, the assertion each control addresses, how a sample size gets set, and how severity gets decided.

03

Controls Register sheet

All sixteen controls from all three cycles in one place: cycle, step, description, type, frequency, assertion, owner, and whether it is key.

04

Test Log sheet

Population, sample size, and the result for every control actually tested this year, passing or not, so a passed control and an untested one are never mistaken for each other.

05

Deficiency Tracker sheet

Every exception the Test Log turned up, with a severity, a written reason for that severity, and what future exposure looks like if the gap stays open. Once the auditor writes it into a management letter, the remediation plan pack is where it gets a named owner and a target date.

06

Space rule: the control sits on the step

A control ID means the numbered step in a cycle's narrative where it stands, never a category held apart from the sequence it protects.

07

Space rule: severity gets a written reason

No deficiency gets filed with a severity and no reason next to it, so the judgment call is visible before the year end close statements are finalized.

How to use it

  1. 1

    Open in River, or download it

    Download the blank pack as Word and CSV files with no account, or open it in River and send a real walkthrough of one cycle.

  2. 2

    Send one cycle's walkthrough

    A recording, notes from sitting with the person who runs it, or a plain description of the steps in order, for order to cash, procure to pay, or close.

  3. 3

    Steps get numbered, then controls get placed

    The sequence is confirmed first; a control is attached only to the specific step where a misstatement could actually arise, and the flow diagram is drawn with its code on that line.

  4. 4

    Build the register, size the sample, log the result

    Controls roll into one register across all three cycles, each key control's sample is sized from how often it runs, and the tie-out this narrative documents becomes what the lead schedule set pack turns into schedules.

Frequently asked questions

Is this template free?

Yes. Four documents and three sheets download as Word and CSV with no account, no card, and no trial. Edit with AI is the optional path for sending a real walkthrough instead of retyping three cycles into this format by hand. The rest of the library is at free templates.

How is this different from a flowchart plus a separate controls list?

Most guides keep them as two files a preparer has to keep consistent by hand, one even says the same control should appear on both. Here the flow diagram is drawn from the numbered narrative itself, so a control's code sits on the same line in both places and the two cannot quietly drift apart the way two separate files can.

How do you size the sample for testing a control?

From how often the control actually ran in the period, not a flat number. A control tested daily draws a larger sample than one that runs monthly, and a control that only fires a handful of times a year, like a vendor banking change, gets tested in full instead of sampled. Castellan's seven key controls tested 74 items this way.

What makes a deficiency significant rather than just a control deficiency?

Whether there is a reasonable possibility the control could fail again and how large the resulting misstatement could get, not the dollar figure this instance happened to involve. PCAOB AS 2201 ties severity to that possibility and its potential size. In the worked example, the smaller dollar exception is the more severe finding, because nothing else in the cycle would have caught it.

Does this replace a SOC 1 report or a formal SOX assessment?

No. 15 U.S.C. 7262 requires a public company's management to assess internal control effectiveness every year, and a SOC 1 is a service organization's own attestation. This pack produces the narratives, register, and test evidence either one gets built from. It documents the process; it does not issue an opinion on it.

How is this different from the segregation of duties review?

They test different things. Segregation of duties reads a permission export and flags who can both create and approve the same transaction. This pack documents the process itself, step by step, and shows exactly where a control sits inside it, which is where a duties conflict actually becomes exploitable in the first place.

Put every control on the step it actually protects

Download the blank pack as Word and CSV files, or open this exact pack in River and send a real walkthrough of one cycle to start.

Edit with AI