Are electronic signatures legally binding?

Yes. Electronic signatures are legally enforceable in interstate transactions under the ESIGN Act (15 U.S.C. §7001) and in most states under UETA; exceptions include wills, certain court filings, and some real estate instruments.

When is notarization required?

Notarization depends on the document's legal effect and state rules; some attestations or certifications may need a notary or remote online notarization under state law and RON requirements.

Who may sign the test?

The signatory should be the control owner or responsible manager with authority to attest to the test results; delegate clearly in governance documents and capture job title and contact information.

How do I correct a completed test?

Create an amended entry or supplemental test with a clear reference to the original record and a new signed attestation; preserve both versions for auditability and change history.

Can I revoke or cancel a signed test?

Revocation should be documented with reason, revoker, and date; if a signature is fraudulent or error-prone, record the revocation and issue a corrected signed record with supporting evidence.

What if a signer cannot access the platform?

Use alternative authentication methods (SMS code, enterprise SSO) or provide a secure paper-signed process that is scanned, timestamped, and entered into the central repository to maintain audit trail continuity.

Business Control Test

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

Business Control Test

Agreement Date:

Client Name: Client Address: Service Provider Name: Provider Address:

Recitals

WHEREAS, Client desires an independent assessment of specified business controls affecting financial reporting, operational resilience, and information security; and

WHEREAS, Service Provider represents that it has the requisite technical expertise, methodologies, and personnel to perform the Business Control Test described in this Agreement; and

WHEREAS, the parties desire to set forth the terms and conditions under which the Business Control Test will be performed and the resulting deliverables provided to Client.

Scope of Work

Service Provider shall perform a Business Control Test limited to the control domains and activities expressly specified below and in the scope description provided by Client. The test shall include design assessment, operating effectiveness testing where applicable, sampling procedures, and preparation of a written report setting forth findings, risk ratings, and recommended remediations.

Detailed Scope Description:

Controls to Be Tested

Select the primary control areas to be included in the Business Control Test (multiple selections permitted):

Access Controls (logical and administrative)
Segregation of Duties and Authorization Controls
Change Management and Configuration Controls
Business Continuity and Disaster Recovery
Physical Security and Environmental Controls
Third-Party Access and Vendor Controls

Payment Terms

Client shall pay Service Provider for the Business Control Test in accordance with the following terms.

Total Fee: Payment Schedule / Milestones:

Payments are due within days of invoice unless otherwise agreed in writing. Late payments shall incur interest at the rate of compounded monthly, plus reasonable collection costs.

Term and Termination

This Agreement commences on and shall continue until , unless earlier terminated in accordance with this section.

Either party may terminate this Agreement for convenience upon providing days' prior written notice to the other party. Either party may terminate immediately for material breach if the breach remains uncured for 15 days after written notice of breach. Termination shall not relieve Client of payment obligations for services performed and costs incurred through the effective date of termination.

Confidentiality

Each party (the Disclosing Party) may disclose Confidential Information to the other (the Receiving Party) in connection with the performance of this Agreement. "Confidential Information" means non-public business, technical, financial, and security information disclosed in any form.

The Receiving Party shall (i) protect Confidential Information with the same degree of care it uses to protect its own confidential information but no less than reasonable care; (ii) use Confidential Information solely to perform its obligations under this Agreement; and (iii) not disclose Confidential Information to any third party except to employees, contractors, or advisors who have a need to know and who are bound by confidentiality obligations at least as protective as those herein.

Exceptions: Confidential Information does not include information that (a) is or becomes public through no breach of this Agreement; (b) was lawfully in the Receiving Party's possession prior to disclosure; (c) is received from a third party without restriction; or (d) is independently developed without use of the Disclosing Party's Confidential Information. Confidentiality obligations shall survive termination or expiration of this Agreement for a period of years.

Deliverables and Reporting

Upon completion of the Business Control Test, Service Provider shall deliver a written report describing scope, methodology, findings (including risk ratings), and recommended corrective actions. Draft reports will be provided for Client review, and final reports shall incorporate Client feedback as reasonably agreed.

Primary Deliverable Due Date:

Representations; Limitations of Liability

Each party represents that it has authority to enter into this Agreement. Service Provider's obligations are limited to performing the Business Control Test with reasonable skill and care in accordance with industry standards. Service Provider's liability for any claim arising out of or relating to this Agreement shall be limited to direct damages not to exceed the total fees paid by Client under this Agreement for the applicable services; in no event shall Service Provider be liable for incidental, consequential, or punitive damages.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the state of without regard to conflicts of law principles. Exclusive jurisdiction for any dispute arising under this Agreement shall lie in the courts located in that state.

Entire Agreement

This Agreement, including any attachments or scope documents expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior proposals, understandings, and communications, whether written or oral. No amendment shall be effective unless in writing and signed by authorized representatives of both parties.

Acknowledgment

The parties acknowledge that they have read and understood this Agreement and agree to be bound by its terms.

Client

Party Label:

By:

Date:

Service Provider

Party Label:

By:

Date:

What the Business Control Test Is and where it fits

A Business Control Test is a structured checklist and evidence collection instrument used to verify that internal controls operate as intended. Organizations use it to document control design, capture test procedures and results, and support financial reporting, compliance reviews, vendor due diligence, or operational audits. Tests typically cover access controls, transaction authorization, segregation of duties, change management, and monitoring activities. The Business Control Test can be completed by control owners, internal auditors, or outside auditors and is often retained as part of the audit record and remediation evidence.

Why conduct a Business Control Test

Running formal control tests provides documented evidence for audits, reduces the risk of undetected control failure, and supports timely remediation. It also demonstrates due diligence to regulators, board members, and external auditors while improving process transparency and accountability.

Who typically completes and signs this test

Different roles use the Business Control Test depending on the control area and organizational structure.

Internal auditors — prepare tests, collect evidence, and report deficiencies to management.
Control owners — complete procedure steps, provide supporting documents, and certify accuracy of responses.
External auditors and consultants — review test results and rely on documented evidence for audit opinions.

Typical user profiles

Controller

Finance leader responsible for internal control over financial reporting. Uses the Business Control Test to confirm monthly close controls, reconcile exceptions, and prepare audit exhibits for external accountants and regulators.

Internal Audit Manager

Leads testing programs and documents test workpapers. Coordinates evidence collection from control owners, tracks remediation, and summarizes findings to the audit committee.

Core components of a professional Business Control Test

A complete Business Control Test combines control descriptions, test steps, evidence fields, results, signatory blocks, and remediation tracking to create an auditable record.

Control Description

Concise statement of the control objective and how it is implemented so readers understand scope and expected outcome.

Test Procedure

Step-by-step instructions for sampling, inquiry, observation, or re-performance that an examiner follows to verify control effectiveness.

Evidence Fields

Structured places to attach logs, screenshots, reports, or transaction samples that substantiate test results and timestamps.

Result & Conclusion

Pass/fail or exception details plus a short conclusion explaining whether the control met the objective.

Signatures

Signed certification by the person who performed the test and an approving manager with date and role recorded.

Remediation Log

Action items, owners, due dates, and subsequent verification steps to demonstrate remediation and closure.

Security and compliance elements to capture

Encryption: AES-256 at rest

Transport: TLS 1.2/1.3

Audit Trail: Detailed event log

Access Controls: Role-based access

Retention: Preserve original record

Certifications: SOC 2 Type II

Primary risks and regulatory consequences

Financial misstatement: SEC investigation risk

Tax reporting fines: IRC §6721 penalties

I-9 violations: 8 CFR §274a.2 fines

HIPAA breaches: 45 CFR §160–164 penalties

Audit qualifications: Qualified or adverse opinion

Reputational harm: Customer and partner loss

Common mistakes that weaken control testing

Incomplete evidence collection — failing to attach logs, screenshots, or transaction samples prevents auditors from verifying test steps and increases follow-up requests.
Ambiguous test steps — vague or non-repeatable procedures yield inconsistent results across different testers and reduce reliability of conclusions.
Missing sign-off — absent or undated signatory blocks create questions about who validated results and when the test was performed.
No remediation tracking — documenting failures without clear owners, deadlines, and verification steps leads to recurring control breakdowns and regulatory scrutiny.

How to complete a Business Control Test step by step

Complete tests in a consistent sequence: define scope, perform procedures, attach evidence, record conclusions, and obtain approvals.

01

Define scope: Identify control objective, period, and sample size.
02

Execute tests: Follow documented procedures and collect evidence.
03

Record results: Mark pass/fail and describe exceptions.
04

Approve: Obtain control owner and manager signatures.

How to set up an online Business Control Test workflow

Configure the digital workflow so testing assignments, reminders, and evidence uploads flow to designated owners automatically.

Field	Configuration
Authentication	Email, SMS code, or enterprise SSO
Notifications	Automated reminders and escalations
Conditional Fields	Show remediation tasks only on exceptions
Template Reuse	Create reusable templates per control family

Where to send or file completed Business Control Tests

Decide centralized storage and routing before testing begins to ensure consistent retention and audit access.

Prepare: Author the test template and assign owners.
Assign: Route individual tests to control owners.
Sign: Collect signatures and approvals.
Archive: Store final signed copies in secure repository.

Digital signing and eSubmission considerations

Choose a platform that supports secure signatures, audit trails, and integrations with your document storage and GRC systems.

File formats: PDF, DOCX, or scanned images
Integrations: Salesforce, NetSuite, Google Workspace
Authentication: Email, SMS, or SAML SSO

Typical timelines and response expectations

Establish timelines for testing cycles, auditor requests, and remediation to ensure timely evidence and avoid penalties.

Annual Testing Deadline:

Complete control testing aligned with fiscal year-end and external audit schedules.

Quarterly Reviews:

Perform interim control reviews each quarter for high-risk processes.

Auditor Request Response:

Respond to document requests within 10 business days where feasible.

Remediation Period:

Address and verify remediation within 90 days of finding discovery.

Document Production:

Provide signed and archived evidence within 30 days when requested by regulators or auditors.

Practical tips for accurate and efficient completion

Follow consistent naming, versioning, and evidence conventions to reduce friction and improve auditability.

Standardize templates

Use a single, approved template for each control family to ensure all necessary fields are completed and to make cross-control comparisons straightforward during audits and management reviews.

Automate reminders

Configure automatic notifications and escalation paths for overdue tests so owners are prompted on time and management receives visibility into bottlenecks.

Use clear evidence naming

Adopt a naming convention that includes control name, date, and evidence type (for example, AccessLog_2026-09-01_Report) to simplify retrieval during reviews.

Record reproducible steps

Write test procedures so another tester can reproduce the work; include sample selection criteria, exact queries or script names, and expected outputs.

How the Business Control Test compares with similar artifacts

The table below contrasts the Business Control Test with a formal SOC 1 report on purpose, assurance level, and typical signers.

Criteria	Business Control Test	SOC 1 Report
Purpose	internal testing	external assurance
Level of Assurance	operational evidence	third-party opinion
Third-party Audit	optional	required
Typical Signers	control owner	independent auditor

eSignature platform pricing and basic feature comparison

Compare common eSignature plan attributes relevant to signing and storing Business Control Tests; signNow is listed first per vendor comparison conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Plan	7-day free trial	Varies	Varies	Limited trial	Limited trial
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently asked questions and common troubleshooting

Answers to common questions address legal validity, signature authority, notarization, revocation, and technical signing issues for Business Control Tests.

Need help? Contact support

Are electronic signatures legally binding?
Yes. Electronic signatures are legally enforceable in interstate transactions under the ESIGN Act (15 U.S.C. §7001) and in most states under UETA; exceptions include wills, certain court filings, and some real estate instruments.
When is notarization required?
Notarization depends on the document's legal effect and state rules; some attestations or certifications may need a notary or remote online notarization under state law and RON requirements.
Who may sign the test?
The signatory should be the control owner or responsible manager with authority to attest to the test results; delegate clearly in governance documents and capture job title and contact information.
How do I correct a completed test?
Create an amended entry or supplemental test with a clear reference to the original record and a new signed attestation; preserve both versions for auditability and change history.
Can I revoke or cancel a signed test?
Revocation should be documented with reason, revoker, and date; if a signature is fraudulent or error-prone, record the revocation and issue a corrected signed record with supporting evidence.
What if a signer cannot access the platform?
Use alternative authentication methods (SMS code, enterprise SSO) or provide a secure paper-signed process that is scanned, timestamped, and entered into the central repository to maintain audit trail continuity.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now