This memo defines the process a company uses to update testing of internal controls for Sarbanes-Oxley compliance purposes near or at the year-end.

Since all testing of controls cannot be performed at year-end, management must perform update testing near year-end in order to verify that controls tested earlier in the year are still operating effectively, any changes to controls have been appropriately documented and tested, and non-routine controls and controls involving a high degree of subjectivity or judgment are updated with additional samples. The process includes determining which controls to select for update testing as well as the type of update testing to perform.