How to Comply with Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control

How to Comply with Sarbanes-Oxley Section 404......Page 3
About the Author......Page 7
Contents......Page 9
Preface......Page 13
Acknowledgments......Page 15
Management’s Required Assessment of the Entity’s Internal Control......Page 17
The Independent Auditor’s Reporting Responsibilities......Page 23
A Structured, Comprehensive Approach for Evaluating Internal Control......Page 30
Considerations for Outside Consultants......Page 34
Appendix 1A: Action Plan: Structuring the Engagement......Page 40
Appendix 1B: Requirements for Management’s Assessment Process: Cross Reference to Guidance......Page 41
Appendix 1C: Pre-Engagement Questioning Strategy and Example Questions......Page 42
The Need for Control Criteria......Page 45
The COSO Internal Control Integrated Framework......Page 46
Information and Communication......Page 60
Monitoring......Page 62
Business Process Activities......Page 63
Controls Over Information Technology Systems......Page 66
Disclosure Controls and Procedures......Page 70
Appendix 2A: Example Value Chains......Page 72
The Objective of Planning......Page 78
Information Gathering for Decision Making......Page 79
Information Sources......Page 88
Structuring the Project Team......Page 93
Coordinating with the Independent Auditors......Page 97
Documenting Your Planning Decisions......Page 98
Appendix 3A: Action Plan: Project Planning......Page 100
Appendix 3B: Summary of Planning Questions......Page 102
Introduction......Page 107
Entity-Level Control Objectives Presumed to Be Significant......Page 109
System-Wide Monitoring......Page 124
Identifying Significant Activity-Level Control Objectives......Page 125
Coordinating with the Independent Auditors......Page 127
Appendix 4A: Action Plan: Identifying Significant Control Objectives......Page 128
Appendix 4B: Example Significant Control Objectives......Page 129
Appendix 4D: Map to the Auditing Literature......Page 132
Documentation: What It Is … And Is Not......Page 136
Assessing the Adequacy of Existing Documentation......Page 138
Documentation of Entity-Level Control Policies and Procedures......Page 140
Documenting Activity-Level Controls......Page 145
Coordinating with the Independent Auditors......Page 151
Appendix 5A: Action Plan: Documentation......Page 152
Appendix 5B: Evaluating the Design and Implementation of Sarbanes-Oxley Automated Compliance Tools......Page 154
Appendix 5C: Linkage of Significant Control Objectives to Example Control Policies and Procedures......Page 161
Appendix 5D: Documentation Example......Page 168
Introduction......Page 175
Internal Control Reliability Model......Page 177
Overall Objective of Testing Entity-Level Controls......Page 180
Testing Techniques......Page 183
Evaluating the Effectiveness of Entity-Level Controls......Page 192
Documenting Test Results......Page 195
Coordinating with the Independent Auditors......Page 196
Appendix 6A: Action Plan: Testing and Evaluating Entity-Level Controls......Page 197
Appendix 6B: Survey Tools......Page 198
Appendix 6C: Example Inquiries of Management Regarding Entity-Level Controls......Page 206
Appendix 6D: Guidance for Designing a Computer General Controls Review......Page 213
Assessing the Effectiveness of Design......Page 222
Operating Effectiveness......Page 225
Documentation of Test Procedures and Results......Page 237
Coordinating with the Independent Auditors......Page 238
Appendix 7A: Action Plan: Documentation......Page 239
Appendix 7B: Example Inquiries......Page 240
Appendix 7C: Example Control Activities......Page 242
Annual and Quarterly Reporting Requirements......Page 268
Expanded Reporting on Management’s Responsibilities for Internal Control......Page 278
Coordinating with the Independent Auditors and Legal Counsel......Page 280
Appendix 8A: Action Plan: Reporting......Page 281
Appendix 8B: Example Disclosures of a Material Weakness......Page 283
Appendix 8C: Example Reports on Management’s Responsibilities for Reporting and Internal Control......Page 288
Index......Page 295