ICFR Checklist

A phase-by-phase checklist for internal control over financial reporting, covering scoping, control design assessment, operating effectiveness testing, and deficiency reporting. Assign control owners and track remediation in one place.

Free download Excel, Word & PDF 28+ ICFR tasks
RK
AP
TN
+
Used by 1,200+ finance teams
ICFR Checklist
Scoping (Week 1)
Identify financially significant accounts
Map material transaction flows
Control Design (Week 2)
Document control objectives per assertion
Evaluate control precision and frequency
Testing (Week 3)
Select samples for each key control
Test IT general controls
Reporting (Week 4)
Classify deficiencies by severity
Draft management assessment report
38% Complete — 3 of 8 tasks done

Build your ICFR checklist

Check off tasks, assign control owners, and set due dates. The live preview updates as you work through each phase.

1

Scoping & Risk Assessment (Week 1)

Identify financially significant accounts and disclosures
Map material transaction flows to financial statement assertions
Determine locations and business units in scope
Perform fraud risk assessment across key processes
Document entity-level controls (COSO framework alignment)
Identify IT systems that support key controls
Review and approve the ICFR scope and timeline
2

Control Design Assessment (Week 2)

Document control objectives for each significant process
Map each control to the relevant financial statement assertion
Evaluate control precision, frequency, and level of review
Assess whether compensating controls exist for identified gaps
Verify segregation of duties across authorization, custody, recording
Review IT general controls: access management, change management, operations
Conduct walkthroughs for each key control with process owners
3

Operating Effectiveness Testing (Week 3)

Determine sample sizes based on control frequency and risk
Test manual controls: approvals, reconciliation reviews, sign-offs
Test automated controls: system validations, auto-calculations, access restrictions
Test IT general controls: user access reviews, change logs, backup verification
Provide evidence for sampled transactions within agreed timelines
Test journal entry controls including non-standard and manual entries
Document exceptions and discuss root causes with control owners
4

Deficiency Evaluation & Reporting (Week 4)

Aggregate and classify all identified control deficiencies
Evaluate severity: material weakness, significant deficiency, or control deficiency
Review deficiency assessments and approve final classifications
Draft management assessment report on ICFR effectiveness
Create remediation plans with owners, actions, and target dates
Present ICFR results to the audit committee
Schedule re-testing for remediated controls before year-end
Live preview
ICFR Checklist
Reporting Period:
0
Done
28
Pending
28
Total

Set up your ICFR checklist in five steps

1

Define scope

Identify financially significant accounts and map them to the business units, locations, and assertions that drive material misstatement risk.

2

Assign owners

Assign an ICFR program lead, control owners for each process, and a finance director to approve scope and final classifications.

3

Assess design

Walk through each key control with its owner. Confirm the control is designed to address the right assertion, operates at sufficient precision, and runs at the right frequency.

4

Test effectiveness

Select samples and test whether each control operated as designed throughout the period. Document exceptions and discuss root causes.

5

Report & remediate

Classify deficiencies, draft the management assessment, present to the audit committee, and schedule re-testing for remediated controls.

Download a ready-to-use ICFR checklist

Excel (.xlsx)

Pre-built with severity dropdowns, assertion mappings, control owner assignments, and auto-calculated completion rates.

Word (.docx)

Print-friendly ICFR workpaper layout with checkboxes, evidence references, and sign-off lines per control.

PDF

Locked format for compliance archives. All 28+ controls grouped by phase with severity and assertion columns.

A 4-week ICFR assessment cycle, mapped out

A typical ICFR assessment runs over four weeks. Here is how the checklist phases map to each week of the evaluation.

W1
Scoping
  • Significant accounts
  • Fraud risk assessment
  • Entity-level controls
  • IT systems inventory
W2
Design Assessment
  • Control objectives
  • Assertion mapping
  • Walkthroughs
  • Gap identification
W3
Testing
  • Sample selection
  • Manual control tests
  • Automated control tests
  • ITGC testing
W4
Reporting
  • Deficiency classification
  • Management assessment
  • Audit committee review
  • Remediation plans
ScopingDesignTestingReporting

Automate ICFR evidence collection

Bluecopa continuously monitors controls, captures evidence automatically, and flags exceptions before your assessors arrive.

Get a Demo →

How ICFR assessments work

Internal control over financial reporting (ICFR) is a process designed by management to provide reasonable assurance that financial statements are reliable and prepared in accordance with GAAP or IFRS. Under SOX Section 404, public companies must assess and report on the effectiveness of these controls annually.

1 Scope & risk-assess

Identify the accounts, disclosures, and assertions most likely to contain a material misstatement. Focus on revenue, estimates, journal entries, and areas with high transaction volume or complexity.

2 Evaluate control design

Walk through each process with its owner. Document how each control addresses a specific assertion (existence, completeness, valuation, rights, presentation) and whether its design is sufficient to prevent or detect misstatement.

3 Test operating effectiveness

Select samples and test whether each control operated consistently throughout the reporting period. Cover manual reviews, automated validations, and IT general controls (access, change management, operations).

4 Evaluate & report

Classify each finding as a material weakness, significant deficiency, or control deficiency. Draft the management assessment, present to the audit committee, and track remediation through re-testing.

Do this, avoid that

✓ Do this

  • ✓ Start with a top-down risk assessment to focus on controls that matter most to the financial statements
  • ✓ Map every key control to a specific financial statement assertion
  • ✓ Test controls over the full reporting period, not just at year-end
  • ✓ Include IT general controls in scope since they underpin most automated controls
  • ✓ Document compensating controls when a primary control has a design gap
  • ✓ Re-test remediated controls before issuing the final management assessment

✕ Avoid that

  • ✕ Treating ICFR as a checklist exercise without understanding the underlying risks
  • ✕ Scoping too narrowly and missing controls around non-routine transactions or estimates
  • ✕ Relying solely on inquiry without inspecting actual evidence of control performance
  • ✕ Ignoring IT general controls and testing only manual business process controls
  • ✕ Classifying deficiencies without evaluating the likelihood and magnitude of potential misstatement
  • ✕ Waiting until year-end to begin testing, leaving no time to remediate findings

ICFR terms, explained

Material Weakness

A deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis.

Significant Deficiency

A deficiency, or combination of deficiencies, in ICFR that is less severe than a material weakness but important enough to merit attention by those responsible for oversight of financial reporting.

Control Objective

A statement of what a control is designed to achieve, typically linked to a financial statement assertion such as existence, completeness, valuation, rights and obligations, or presentation and disclosure.

Entity-Level Controls

Controls that operate at the organization level rather than the process level. They include the control environment, risk assessment, monitoring, and information and communication components of the COSO framework.

IT General Controls

Controls over IT systems that support the reliability of automated controls and data integrity. They include user access management, program change management, computer operations, and program development.

Management Assessment

A report by management on the effectiveness of the company's ICFR as of the end of the fiscal year, required under SOX Section 404(a). External auditors issue a separate attestation under Section 404(b) for accelerated filers.

Frequently asked questions

ICFR stands for internal control over financial reporting. It refers to the processes and controls an organization puts in place to provide reasonable assurance that its financial statements are reliable and compliant with applicable accounting standards. For public companies in the United States, management must assess and report on ICFR effectiveness annually under SOX Section 404.
Management is responsible for designing, implementing, and maintaining ICFR. Typically, the CFO or controller leads the effort, supported by an ICFR program lead who coordinates testing and a network of control owners across finance, IT, and operations. The audit committee provides oversight, and external auditors issue an independent opinion on ICFR effectiveness for accelerated filers.
Both are deficiencies in ICFR, but they differ in severity. A material weakness means there is a reasonable possibility of a material misstatement not being prevented or detected. A significant deficiency is less severe but still important enough to require attention from those overseeing financial reporting. Material weaknesses must be disclosed publicly; significant deficiencies must be communicated to the audit committee.
The number depends on the organization's size, complexity, and risk profile. Focus on key controls: those directly addressing the risk of material misstatement for significant accounts and disclosures. A mid-size public company might have 50 to 150 key controls. Sample sizes for each control depend on the control's frequency (daily, monthly, quarterly, annual) and the risk of the process it supports.
IT general controls (ITGCs) underpin the reliability of automated controls and data processed by IT systems. If ITGCs are ineffective, you cannot rely on the automated controls they support. Common ITGC areas include user access management, program change management, computer operations, and program development. Testing ITGCs is a mandatory part of any ICFR assessment.
Yes. Platforms like Bluecopa, AuditBoard, and Workiva automate control documentation, evidence collection, and testing workflows. The biggest advantage is continuous monitoring: instead of point-in-time testing at year-end, the software flags control exceptions in real time. This reduces the risk of late-stage surprises and makes remediation faster since issues surface as they happen rather than months later.

Related checklists

SOX 404 Compliance Checklist

Section 302 and 404 requirements mapped to controls testing and CEO/CFO certification tasks.

Internal Audit Checklist

Planning, controls review, fieldwork, and reporting tasks for a 4-week internal audit cycle.

Segregation of Duties Checklist

Authorization, custody, and recording separation across finance, procurement, and IT processes.

Audit Trail Checklist

Configuration, data capture, integrity testing, and retention tasks for complete audit trail compliance.

Browse all checklists

Bank Reconciliation Checklist SOX 404 Compliance Checklist Segregation of Duties Checklist ICFR Checklist Intercompany Close Checklist Audit Trail Checklist E-Invoicing Compliance Checklist Flux Analysis Checklist GST Reconciliation Checklist Intercompany Reconciliation Checklist TDS Reconciliation Checklist SAP Month-End Close Checklist Oracle Month-End Close Checklist D365 Month-End Close Checklist Internal Audit Checklist Month-End Close Checklist
View all checklists →