Under Sarbanes Oxley, management of the company needs to assess the design as well as operating effectiveness of internal controls. When management is making an assessment of internal controls, management needs to ensure that the results of such evaluation are documented. Documentation acts as direct evidence that management's findings are reasonable and can be relied on. Such documentation which supports management's assessment of internal controls over financial reporting normally includes the documents listed below. I am just making an illustrative list below:

1. Documentation showing how controls are designed. Design of controls will include their mapping to relevant financial statement assertions and disclosures.
2. Documentation illustrating how significant transactions are initiated, authorized, recorded, processed and reported.
3. Documentation for the five COSO components.
4. Document showing controls over the period end closing activities.
5. Document showing preventive as well as detective controls for fraud.
6. Documentation substantiating management's testing of controls.
7. Documentation for material weaknesses and significant deficiencies noted.