Controls Testing Plan Builder

The Controls Testing Plan Builder turns a control inventory into a defensible, risk-based annual testing plan. You set the methodology once — rotation intervals by risk rating, sample sizes by control frequency, effort per test method — or keep the ISAE 3402 / SOX-style defaults, and every number is editable. List your controls (or load a fictional demo inventory to see the whole flow), and the plan derives itself: which controls are in scope this cycle, how each is tested, the sample size, the timing and the estimated effort. The point is defensibility. Every control in the plan carries its scoping rationale, and everything left out appears under "Not in this cycle" with the reason — reliance on an ISAE 3402 report, a rotation deferral, a manual scope-out. Nothing is hidden in a formula. Export the whole thing to Excel with a methodology tab that records exactly the parameters you used, or print the summary. Everything runs in the browser. No account, no upload, nothing transmitted — the export is your save file.

• Editable methodology — rotation by risk rating, sample sizes by frequency, effort per test method, with ISAE 3402 / SOX-style defaults
• Risk-based scoping — rotation clock, the never-tested rule, key-control switch and manual overrides, each explained
• Every control in the plan carries its scoping rationale; every exclusion carries its reason
• Derived test design — method, sample size, timing and effort computed per control
• Excel export (plan + inventory + methodology tab) and a printable summary
• A one-click fictional demo inventory to see the whole flow end to end
• Fully browser-based — nothing stored, nothing transmitted

Internal control and assurance teams build their annual testing plans by hand — deciding what to test this year, how deeply, and on what sample, then assembling it in a spreadsheet whose logic lives in the author's head. The result is hard to defend in front of an audit committee or an examiner: why was this control in scope and that one not, and on what basis was the sample size chosen? This tool encodes a common, editable methodology and derives the plan from it — so the scoping is explicit, the rationale is on every row, and the exclusions are listed with their reasons. It connects to the Luxembourg internal-audit context too: point 51 of Circular CSSF 22/806 requires the internal audit plan to include outsourcing arrangements of critical or important functions, which can be qualified first with the Regime Classifier and carried into the plan.