Why It's Time to Retire IPE: A Smarter Approach to SOX
Information Produced by the Entity, commonly known as IPE, has been a cornerstone of SOX compliance testing for years. While the concept behind IPE remains sound, the way most organizations manage it has become a significant source of inefficiency. It may be time to rethink the approach entirely.
What Is IPE?
IPE refers to any report, data extract, or output generated by the company's own systems that is used as evidence in internal control testing. When an auditor relies on an aging report to test an accounts receivable control, that aging report is IPE. When management uses a system-generated list of journal entries to test segregation of duties, that list is IPE.
The principle is straightforward: if you are using company-generated data to test a control, you need to verify that the data itself is accurate and complete. Otherwise, the entire test conclusion rests on an unvalidated foundation.
The Problem with Current IPE Practices
In theory, IPE validation is a reasonable safeguard. In practice, it has become one of the most burdensome and least valuable aspects of SOX compliance.
Most organizations validate IPE by performing completeness and accuracy checks on every report used in control testing. This often means re-running reports, tying totals to source systems, and documenting the validation in separate workpapers. For organizations with hundreds of controls, each relying on multiple reports, the volume of IPE validation work is enormous.
The effort is compounded by the fact that many of these reports are generated by the same systems, using the same data, on a recurring basis. Yet teams often validate each instance independently, even when the underlying data source has not changed.
Why the Traditional Approach Falls Short
Redundant effort. Teams frequently validate the same system output multiple times across different controls. An ERP-generated trial balance might be validated separately for revenue testing, expense testing, and balance sheet review, despite being the same report from the same system.
Documentation overhead. Each IPE validation requires its own documentation, creating a paper trail that adds volume without proportional value. Auditors spend more time documenting the validation than performing it.
False sense of assurance. Checking that a report total matches a system total confirms that the report was generated correctly. It does not address whether the underlying data in the system is accurate. The validation tests the report, not the data.
Resource drain. IPE validation consumes audit hours that could be directed toward higher-risk areas. When teams are stretched thin during busy season, this misallocation of effort has real consequences.
A Smarter Alternative
Rather than validating individual report instances, organizations should consider a system-level approach. This means establishing confidence in the systems that produce reports, rather than testing each output separately.
IT general controls (ITGCs) already address the integrity of system-generated data. When ITGCs over a particular application are effective, there is reasonable assurance that reports generated by that application are reliable. Strengthening the link between ITGC testing and IPE reliance can significantly reduce duplicative work.
Automated reconciliations can replace manual IPE checks. When data flows are reconciled automatically between systems, the need for point-in-time IPE validation diminishes. The reconciliation itself provides continuous assurance.
Standardized data sources reduce the number of unique IPE items that require validation. If all controls within a process rely on the same data extract, validate the extract once rather than separately for each control.
What This Means for Audit Teams
Retiring the traditional IPE approach does not mean abandoning data validation. It means being strategic about where and how validation effort is applied. Focus on the systems and data flows that pose the greatest risk. Leverage ITGCs and automated controls to provide assurance over system outputs.
Modern audit tools can support this transition by maintaining direct links between source data and workpapers, reducing the need for manual validation. Platforms like Blast Audit, which extract and match data within Excel, create traceable connections between evidence and conclusions that reduce reliance on standalone IPE documentation.
The goal is to redirect effort from low-value documentation toward higher-value analysis, ultimately making the SOX compliance process both more efficient and more effective.