Purpose: This is the testing worksheet for the respective control objective and activity / activities.

Site Audited
Audit Type
If Not a Standard Audit Type, Explain Purpose of Review
Review Stage
Cycle Expenses
Testing performed by
Date of test
Testing reviewed by
Date of review

Control Objective EX-020-010 Purchasing Approvals - All purchases are approved by management.

Risk Addressed: Inventory related purchases are not approved appropriately.

The Purchasing function procures inventory, supplies, and services to satisfy production requirements and to maintain the
Guidance / Risk Addressed facilities and equipment The purchasing function should not acquire goods or services for which a proper management
approval has not been obtained.

Activity
Control Activity # Control Activity Description SOX or OKC
Scope

Materials management has a process to review that customer's finished goods

demand is loaded into the ERP system (MPS - Master Production / Planning
Control Activity EX-020-010-030 OKC
Schedule) from forecasts or firm orders provided by the customer.

Process Owner (Contact Person @ Site for This Control Objective)

Process Owner Job Position

The test for EX-020-010-030 requires, through discuss with relevant materials management, reviewing the procedures / process
Prescribed Test(s) of converting customers forecast or orders into raw material purchasing requirement.

Frequency (select closest value)

Sample Size (per sample size guideline / prescribed audit test)

Additional Samples Selected (based on testing exceptions)

Base Data For Sample Selection Provided By

Name & Title of Person Providing Base Data (If Not ARMS)

Date Range / Period(s) of Base Data Used For Sample

System That Sample Selection Data Was Obtained From

Company Number(s) - if applicable

Was The Prescribed Test Performed?

If The Prescribed Test Was Not Performed, Or Was Only Partially

Performed, Explain Why And What Was Tested Instead

Attributes Detailed Test Procedures (Attributes)

A There is a process in place to convert customers forecasts or orders into raw material purchasing requirement.
B
C
D
E
F

Sample Table (please add / delete rows as necessary, based on the frequency)

Material Attribute Testing Performed (use tickmarks) Testing

# Management Exception Comments
Process Identified? (Y/N)
A B C D E F

Customer's
1 Finished Goods
Demand Process.

2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

Other Notes / Additional Documentation of Work Performed or

Process Details / Significant changes to the process / system in use
since previous year audit (Only If Deemed Necessary)

Examples of Deficiencies / Other Documentation (attach samples of

deficiencies or other documents as deemed appropriate)

Control Effectiveness EX-020-010-030

(choose from drop-down list)

Control Deficiency Description EX-020-010-030

Control Objective PDM-010-020

Vendor performance is sub-par and is n

Guidance / Risk Addressed
If vendor performance is not monitored

Control Activity #

Control Activity PDM-010-020-010

Process Owner (Contact Person @ Site for This Control Objective)

Process Owner Job Position

The test for PDM-010-020-010 requires o

1. All vendors of direct materials (includ

periodically evaluated. Check the curre
stated in the policy if (check other reas
- The supplier is to provide products to
- The supplier is to provide a new produ
- The suppliers manufacturing location
- The supplier has major process or fac

Prescribed Test(s) 2. Review the vendor evaluation forms

evaluation has been performed by cros
quality control department.

3. Check if evaluation results have been

been discontinued. Otherwise, reasons

Note: Re. independent authority in 3) ab

continue to buy from them and then yea
judgment to determine whether the site
 The test for PDM-010-020-010 requires o

1. All vendors of direct materials (includ

periodically evaluated. Check the curre
stated in the policy if (check other reas
- The supplier is to provide products to
- The supplier is to provide a new produ
- The suppliers manufacturing location
- The supplier has major process or fac

Prescribed Test(s) 2. Review the vendor evaluation forms

evaluation has been performed by cros
quality control department.

3. Check if evaluation results have been

been discontinued. Otherwise, reasons

Note: Re. independent authority in 3) ab

continue to buy from them and then yea
judgment to determine whether the site

Frequency (select closest value)

Sample Size (per sample size guideline / prescribed audit test)

Additional Samples Selected (based on testing exceptions)

Base Data For Sample Selection Provided By

Name & Title of Person Providing Base Data (If Not ARMS)

Date Range / Period(s) of Base Data Used For Sample

System That Sample Selection Data Was Obtained From

Company Number(s) - if applicable

Was The Prescribed Test Performed?

If The Prescribed Test Was Not Performed, Or Was Only Partially
Performed, Explain Why And What Was Tested Instead

Attributes
A
All vendors are evaluated on regular ba
B
Important criteria are taken into accoun
C Evaluations are reviewed by independe
D Criteria was used for evaluation
E
F

Sample Table (please add / delete row

Attribute Testing Performed (use tickmarks)

# Vendor

A B C
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
Sample Table (please add / delete row
Attribute Testing Performed (use tickmarks)
List of evaluation
#
criteria
 List of evaluation
#
criteria D

2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

Other Notes / Additional Documentation of Work Performed or Process

Details / Significant changes to the process / system in use since previous
year audit (Only If Deemed Necessary)

Examples of Deficiencies / Other Documentation (attach samples of

deficiencies or other documents as deemed appropriate)
Control Effectiveness
(choose from drop-down list)

Control Deficiency Description

 Vendor performance is periodically (in line with Supplier Qualification Procedure) evaluated to ensure that the Com
are met.

performance is sub-par and is not tracked.

performance is not monitored, the company could continue to use suppliers that are providing less than optimal quality and

Control Activity Description SOX or OKC

Vendor post-performance is regularly evaluated to ensure that goods have been

purchased at favorable terms and that vendors have performed to the expected
standards. Such evaluations are performed in-line with Corporate requirements OKC
(Supplier Qualification Procedure GPO-GPO-3-033-00) and documentation of
these reviews is maintained.

for PDM-010-020-010 requires obtaining latest vendor evaluation performed and review for the following:

ndors of direct materials (including ones on Approved Vendor List, Preferred Suppliers List, contractual, etc) not introduced by
ally evaluated. Check the current requirements of frequency in the policy. Please note that suppliers must be evaluated regard
the policy if (check other reasons in the policy):
pplier is to provide products to a new segment
pplier is to provide a new product to existing segment
ppliers manufacturing location change
pplier has major process or factory change

w the vendor evaluation forms and check that important criteria have been considered e.g. delivery lead time, service, and qua
on has been performed by cross functional team with relevant knowledge, e.g. delivery lead time is evaluated by logistics and
ontrol department.

if evaluation results have been reviewed by independent authority and actions have been followed up, i.e. vendor which has f
continued. Otherwise, reasons should be documented and retention of vendor should be duly approved.

. independent authority in 3) above: This should not be someone outside of the site, but someone not able to introduce the ve
to buy from them and then year after year evaluate the supplier without anyone independently reviewing performance and pri
t to determine whether the site has assigned this to the right persons.
for PDM-010-020-010 requires obtaining latest vendor evaluation performed and review for the following:

ndors of direct materials (including ones on Approved Vendor List, Preferred Suppliers List, contractual, etc) not introduced by
ally evaluated. Check the current requirements of frequency in the policy. Please note that suppliers must be evaluated regard
the policy if (check other reasons in the policy):
pplier is to provide products to a new segment
pplier is to provide a new product to existing segment
ppliers manufacturing location change
pplier has major process or factory change

w the vendor evaluation forms and check that important criteria have been considered e.g. delivery lead time, service, and qua
on has been performed by cross functional team with relevant knowledge, e.g. delivery lead time is evaluated by logistics and
ontrol department.

if evaluation results have been reviewed by independent authority and actions have been followed up, i.e. vendor which has f
continued. Otherwise, reasons should be documented and retention of vendor should be duly approved.

. independent authority in 3) above: This should not be someone outside of the site, but someone not able to introduce the ve
to buy from them and then year after year evaluate the supplier without anyone independently reviewing performance and pri
t to determine whether the site has assigned this to the right persons.
 Detailed Test Procedures (Attributes)

ors are evaluated on regular basis

nt criteria are taken into account during the evaluation process

ons are reviewed by independent authority
was used for evaluation

e Table (please add / delete rows as necessary, based on the frequency)

ng Performed (use tickmarks) Testing

Exception Comments
Identified? (Y/N)

e Table (please add / delete rows as necessary, based on the frequency)

ng Performed (use tickmarks)
Testing
Exception Comments
Identified? (Y/N)
 Testing
Exception Comments
Identified? (Y/N)
valuated to ensure that the Company's expectations

g less than optimal quality and service.

Activity Scope

following:

ntractual, etc) not introduced by customer are

pliers must be evaluated regardless the frequency

very lead time, service, and quality. Assess if

e is evaluated by logistics and quality is evaluated by

wed up, i.e. vendor which has failed evaluation has

approved.

ne not able to introduce the vendor to the site,

reviewing performance and pricing. Use your audit
Comments

Comments
Comments
Control Objective PDM-010-020

Vendor performance is sub-par and is n

Guidance / Risk Addressed
If vendor performance is not monitored

Control Activity #

Control Activity PDM-010-020-020

Process Owner (Contact Person @ Site for This Control Objective)

Process Owner Job Position

The test for PDM-010-020-020 requires t

compliant with SRS Supplier Rating Sys
Prescribed Test(s) 1. Check if all suppliers are rated based
2. Review the ratings history and check

Frequency (select closest value)

Sample Size (per sample size guideline / prescribed audit test)

Additional Samples Selected (based on testing exceptions)

Base Data For Sample Selection Provided By

Name & Title of Person Providing Base Data (If Not ARMS)

Date Range / Period(s) of Base Data Used For Sample

System That Sample Selection Data Was Obtained From

Company Number(s) - if applicable

Was The Prescribed Test Performed?

If The Prescribed Test Was Not Performed, Or Was Only Partially

Performed, Explain Why And What Was Tested Instead

Attributes
A
All vendors are rated
B
Corrective actions has been performed
C
D
E
F

Sample Table (please add / delete row

Attribute Testing Performed (use tickmarks)

# Vendor

A
1
2
3
4
5
6
7
 8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
Sample Table (please add / delete row
Attribute Testing Performed (use tickmarks)
Vendor requiring
#
correcdtive actions B

2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

Other Notes / Additional Documentation of Work Performed or Process

Details / Significant changes to the process / system in use since previous
year audit (Only If Deemed Necessary)
Other Notes / Additional Documentation of Work Performed or Process
Details / Significant changes to the process / system in use since previous
year audit (Only If Deemed Necessary)

Examples of Deficiencies / Other Documentation (attach samples of

deficiencies or other documents as deemed appropriate)

Control Effectiveness
(choose from drop-down list)

Control Deficiency Description

 Vendor performance is periodically (in line with Supplier Qualification Procedure) evaluated to ensure that the Com
are met.

performance is sub-par and is not tracked.

performance is not monitored, the company could continue to use suppliers that are providing less than optimal quality and

Control Activity Description SOX or OKC

The supplier rating system onsite is fully compliant with Corporate requirements
(SRS Supplier Rating System Process MAT-MAT-2-002-0) and all suppliers are
OKC
rated according to measures in the procedure. Corrective actions with suppliers
take place when required.

for PDM-010-020-020 requires through discussion with Material Maanagement checking the actual rating system used onsite a
nt with SRS Supplier Rating System Process MAT-MAT-2-002-0.
if all suppliers are rated based on the measures provided by the process.
w the ratings history and check whether there were issues which should imply with Corrective actions and these were perform
 Detailed Test Procedures (Attributes)

ors are rated

ve actions has been performed when required

e Table (please add / delete rows as necessary, based on the frequency)

ng Performed (use tickmarks) Testing

Exception Comments
Identified? (Y/N)
e Table (please add / delete rows as necessary, based on the frequency)
ng Performed (use tickmarks)
Testing
Exception Comments
Identified? (Y/N)
valuated to ensure that the Company's expectations

g less than optimal quality and service.

Activity Scope

ual rating system used onsite and ensuring it is

actions and these were performed.

Comments
Comments