The short answer
In Workiva, SOX and internal controls work is organized as connected records: business processes, the risks within them, the controls that address those risks, control testing, evidence requests, issues with remediation, and management certifications. Workiva markets this today as Controls Management within Workiva GRC. A setup works when every control has an owner, a test approach, an evidence path, and a clear route from exception to closure, and when reporting reads from those records instead of from side spreadsheets.
What Controls Management covers in practice
For a SOX program covering internal control over financial reporting (ICFR), the work is the same whether it runs in spreadsheets or a platform. You document business processes, identify what could go wrong in each one, design controls to address those risks, test that the controls are designed and operating effectively, collect evidence, evaluate anything that fails, fix it, and have management certify the result.
What Workiva adds is that these are connected records rather than separate files. A control points to the risks it addresses and the process it sits in. A test points to the control, its sample, and its evidence. An issue points to the test exception that raised it and carries its deficiency evaluation and remediation. Status reporting reads from those records.
The records and how they connect
| Record | What it holds | Design decision that matters |
|---|---|---|
| Process | The business cycle, such as revenue, procure-to-pay, or financial close | How granular to go; too fine and ownership fragments |
| Risk | What could go wrong, often tied to financial statement assertions | Consistent wording so one risk is not recorded five ways |
| Control | The activity that addresses the risk: owner, frequency, type, key or non-key | One control per record; split combined controls |
| Test of design and operating effectiveness | Walkthrough, test procedures, sample, test exceptions, conclusion | Standard test steps per control type |
| Evidence request (PBC) | What the control owner must provide, by when | Requests written so the owner can fulfill them without a meeting |
| Issue and remediation | The test exception, its deficiency evaluation (control deficiency, significant deficiency, or material weakness), the action plan, and retest | A defined path from exception to closure |
| Certification | Management sign-off for the period | Who certifies which scope, and what they see before signing |
The risk and control matrix (RCM) workbook shows these fields in a form you can use to clean up a matrix before it moves.
Where Workiva SOX setups go wrong
The matrix moves over unchanged. Years of edits leave duplicate controls, inconsistent risk statements, and controls that bundle three activities. Moving that into a platform preserves every problem and adds history to each one.
Ownership is assigned to a team. A control owned by “Accounting” has no one to receive an evidence request. Every control and every open item needs a named person, with a backup.
Evidence requests are vague. “Provide support for the control” produces a folder of screenshots and a follow-up call. Good requests name the report, the period, the sample, and what the reviewer will look for. The evidence request builder is a template for exactly this.
Exceptions have nowhere to go. A failed test gets a comment and nothing else. A working setup raises an issue with an owner, a deficiency evaluation, an action plan, and a retest. See the issue remediation and closure example.
Reporting lives in a side spreadsheet. If the SOX status deck is rebuilt by hand from exports every quarter, the platform is being used as a filing cabinet. Status, testing progress, and open issues should report from the records themselves.
- Overview
- Process, risk, control
- A named owner
- Evidence request
- Control test
- Issue
- Reporting from the records
A practical order of work
- Rationalize the matrix before migration: one control per record, consistent risks, named owners.
- Standardize test approaches by control type so testers produce comparable results. The control testing worked example shows the level of detail that makes review fast.
- Write evidence requests that a control owner can fulfill without a meeting.
- Define the issue path: who evaluates deficiency severity, who owns remediation, and what closes the issue.
- Build reporting from the records for the audit committee and external auditors.
- Rehearse one quarter with the real team before calling the setup complete.
If you are already live
Most programs do not need to start over. Common targeted fixes include consolidating duplicate controls, rewriting evidence requests, adding an issue and remediation workflow that was skipped at launch, and replacing a manually built status report with one driven by the records. Those changes can usually be made between testing cycles; agree any change to key controls or their descriptions with your external auditor first.
Common questions
What is Workiva Controls Management?
It is the part of Workiva GRC used for SOX and internal controls: documenting processes, risks, and controls, planning and performing control testing, collecting evidence, tracking issues and remediation, and supporting management certification. In March 2026 Workiva introduced its next-generation, AI-powered Workiva GRC platform, organized as Controls Management, Audit Management, and Risk Management.
Can we move our existing risk and control matrix into Workiva?
Usually yes, but clean it first. Duplicate controls, inconsistent risk wording, missing owners, and combined controls that should be separate all get harder to fix once they are records with history and links. A migration is the best time to rationalize the matrix.
Does Workiva replace our SOX methodology?
No. Workiva holds and routes the work. Your methodology still defines scoping, key controls, test approaches, sample sizes, and how deficiencies are evaluated. Configure the platform around the methodology.
How long does a Workiva SOX implementation take?
A program with a clean, well-owned matrix is typically measured in weeks to a few months; one that needs the matrix rationalized first, covers many entities, or brings over testing history takes longer. The state of the control documentation drives most of the difference.
Working on a SOX program in Workiva?
Describe where the program slows down: the risk and control matrix, evidence requests, control testing, issues, or status reporting. Every engagement starts with a fixed-fee Workiva diagnostic.
Start a conversationWorkiva GRC services for SOX, internal audit, and ERM