What is a “Key” Control?
It still surprises me that, after nearly 5 years of SOX history, many organizations I encounter still struggle with the question - “what is a key control?”.
Sarbanes Oxley requires the materially accurate reporting of financial results for publicly traded organizations. Consequently, the easiest way to identify which controls are key is to ask yourself - ”does this control impact an account in the financial statements or a disclosure in the footnotes?”. For many of the controls identified by my clients the answer is “no”.
As an example, let’s examine a control which obviously impacts the financial statements - the bank reconciliation. When an individual performs the monthly bank reconciliation, they are utilizing an independent, third-party provided document to ensure the existence and accuracy (and probably completeness and cut-off) of transactions related to the Cash account. There is little doubt that every organization executes this control and that it is essential to the accuracy of reported financial results.
As a counterpoint, let’s consider a control encountered time and again in the Human Resources or Payroll cycles of large organizations throughout the U.S - “Employee benefit requests and transactions are appropriately reviewed, approved, and validated to support”. In my estimation, this is not a key control for SOX purposes.
Although many have argued the point with me, I submit the following:
- How material is any amount related to these types of transactions at any point in time, especially at a quarter end?
- For balance sheet-related escrow/liability accounts, isn’t the periodic account reconciliation sufficient?
- For income statement-related expense accounts (employer 401k, employer portion of health insurance, etc) any variance from actual would likely be identified during a fluctuation analysis - current to prior or current to budget or both.
My point is this - what might be “key” to a process may not necessarily be key when looking at the financial balance being evaluated because multiple cycles/processes likely impact that balance and a control in another process may be sufficient for management to make assertions about that balance. In short, sourcing the account/assertion intersection from the top-down to a sufficiently robust and precise control should enable management to avoid testing controls that may be important to a process, but less so for getting the reported balance materially correct.
C’mon and Ask Some Questions/Leave Comments
We’re getting great traffic on this site, but the conversation is defintely one-sided. Please leave some questions/comments and really make this site interactive!!
Splitting the “Assertion” hair; the key to avoiding “Over Optimization”
AS5 gave public company management license to “optimize” their control environments. The top-down, risk-based approach directed management to lift their gaze from the maze of process level controls and, instead, ensure that the controls they were testing actually mattered when it came to getting reported financial balances right. The way to do that was to match relevant financial statement assertions to material balances for in-scope locations. Most companies were already getting the materiality calculation right, but what about the assertions? What are assertions, exactly, and how can a refinement of the assertion list aid management in avoiding “over-optimization” and exposing themselves to a potential restatement of financial results?
Financial assertions have always existed but they tended to be implicit in nature. For instance, reported Cash balances implicitly Existed and were adequately Safeguarded and Complete. Proper Cut-Off ensured that all transactions were reported in the proper period and management appropriately Authorized those transactions. Management possessed Rights to the asset and, if pledged or otherwise restricted, that fact was fully Disclosed.
However, due to the myriad financial reporting scandals - Enron, Worldcom, Adelphia, Tyco, ad nauseum - that occurred during the early part of this decade, Congress enacted Sarbanes-Oxley (SOX) which, among other things, requires senior management (CEO and CFO) to explicitly assert to the reported balances. As a result, Assertions have recently received much more attention.
In my experience, companies typically utilize five assertions: Existence/Occurrence, Completeness, Valuation/Allocation, Rights/Obligations, Presentation/Disclosure. The Risk and Control Matrices I’ve encountered generally have an abudance of check marks - usually over-associating controls and assertions - leading me to conclude that a lack of understanding of the basic definitions exists. I’ve found that splitting those five into a broader list of thirteen assertions generally leads to a better understanding of what management is attempting to achieve with each control:
Existence/Occurrence
- Existence - Balance Sheet focused - Assets, Liabilities and Ownership Interests (Equity) exist as of the statement date and balances have a real world counterpart (i.e. customers, suppliers, employees, banks, etc).
- Safeguard Assets - Access to assets and critical documents that control their movement are suitably restricted to authorized personnel. Often covered as part of Segregation of Duties review.
- Occurrence - Income Statement focused - Transactions and events that have been recorded actually occurred and pertain to the entity.
Completeness
- Completeness - All transactions and events that should have been recorded have been recorded.
- Cut-Off - Transactions and events have been recorded in the proper period.
Valuation/Allocation
- Valuation - Amounts based on estimates and judgementsare in accordance with US GAAP
- Allocation - Costs are allocated from the Balance Sheet to the Income Statement in the proper period (e.g. depreciation and amortization).
- Accuracy - Amounts recorded are mathematically accurate.
Rights/Obligations
- Rights - The entity holds the rights to the assets.
- Authorization - Transactions are executed in accordance with management’s general and specific authority.
- Obligations - Liabilities recorded are the obligation of the entity.
Presentation/Disclosure
- Classification - financial statement focused - transactions and events have been recorded in the proper accounts.
- Understanding - disclosure driven (generally footnotes) - financial information is appropriately described and understandable to users.
While this may initially seem like an esoteric exercise, splitting the five into thirteen actually achieves two things:
- Reduce the overall amount of time needed to test the control environment. Risk focused testing means the nature of the testing (Inquiry/Observation, Examination, Reperformance) can vary for two different controls providing assurance over two different assertions. For instance, Completeness becomes Completeness and Cutoff and, consequently two different assertion risk scores. If we combine the two, then the testing must satisfy the riskiest of the two.
- Prevent over-reliance on a control. An intersection of account/control/assertion on the Risk and Control Matrix could lead to incorrect conclusions regarding the assurance provided. Once again utilizing Completeness as our example, it is possible that we would need two different controls to achieve assurance that all transactions have been recorded and that they have been recorded in the correct period. If we do not adequately delineate between Completeness and Cut-Off, then we could inappropriately assume that a control mapped to the account/assertion intersection would enable management to explicity assert that the risk of misstatement has been mitigated.
The first point is important and, I believe as a result of AS5, has been seized upon by management to reduce the time required to test key SOX controls and make the process more efficient. However, my concern is that the second point is often overlooked. In the rush to “optimize” their control environment, management may inadvertantly “over-optimize” or fail to identify and test a control that will enable them to certify that all subsections of a particular assertion have been covered and, consequently, expose the organization to the arguably greater risk for restatement of reported financial results. Therefore, management should consider the evaluation of accounts at the greater granularity of thirteen assertions to obtain an ”insurance policy” of sorts to reduce the risk of misstatement.
External Auditor Reliance on Management Testing
In an effort to reduce overall SOX compliance costs, companies must find a way to reduce external audit fees by increasing the amount of reliance the auditors place on management’s testing of its control environment. In a 2006 comment letter to the SEC/PCAOB, a group of controllers and CFOs made several recommendations including the following:
53% of companies (*see attribution below) indicate that auditor reliance on management testing is their primary discussion issue with their external auditors. We believe that auditors should have more flexibility to rely on management’s work, including process owners, for areas that are not considered to be at high risk. For example, automated transaction controls or controls over routine processes involve lower risk and can be tested by process owners. It is important that process owners are accountable for effective controls, but auditors believe that AS2 prevents them from relying on process owner assessments. This causes duplicate testing and is disruptive to operations. Auditors should be allowed to rely on the quality of managements’ overall compliance approach, including the presence of a robust compliance environment and entity- level controls, rather than focusing on individual assessor independence.
We are therefore recommending that external auditors be required to rely on management’s work in testing (irrespective of entity performing the testing) for a mutually-agreed upon universe of low-risk controls.”
Submission of Comments to the SEC/PCAOB Roundtable, May 10 2006
- *Corporate Executive Board research; http://www.executiveboard.com
AS5 addressed this concern by specifically directing auditors to rely more on the work of others. However, more than 40% of the 257 companies, which participated in a September 2007 poll taken by the Institute of Internal Auditors, indicated their external auditors relied on less than 25% of the testing work performed by management. Clearly, gains can be made - but what can be done to change the minds of auditors? The first, and perhaps most important, step is for management to demonstrate an understanding of its environment via a robust assessment of the risks to accurate financial reporting.
Whether the assessment is the traditional “likelihood and impact” approach for each of the identified risks, or management chooses to utilize the risk factors identified by the PCAOB/SEC, or some other method entirely, the point of the exercise is to give external auditors a view into management’s evaluation of what could go wrong. Ranking the relative risk of the resulting misstatements, and the controls that mitigate those risks, then provides a tool for framing the “reliance” discussion. In year one, auditors may then be more comfortable relying on management’s testing of those controls that mitigate low level risks. As time progresses and the risk discussion matures, management and auditors may achieve a balance of reperformance and reliance resulting in reduced cost of compliance.
Evaluating Internal Control over Financial Reporting
INTRODUCTION
Last year’s passage of Auditing Standard No. 5 (AS-5) seems to have been the Public Company Accounting Oversight Board’s (PCAOB) attempt to swing the Sarbanes Oxley regulatory pendulum back from the process oriented, control-centric, “kitchen sink” approach to one that allowed companies to make intelligent choices around properly mitigating their financial reporting risks via a top-down risk assessment. This in theory should have significantly lowered the amount of work to be done and the costs to be incurred. Furthermore, Auditing Standard 5 also encouraged auditors to rely on the work of others (i.e. documenting and testing key controls) when evaluating the system of internal control, which should have reduced the overall costs of SOX compliance even further. Unfortunately, in practice, these savings have not been fully realized
In point of fact, external auditors often duplicate their clients’ internally-generated work or perform testing of controls deemed non-key because of management’s inability to clearly and succinctly demonstrate how their own efforts addressed the organization’s financial reporting risks for the relevant assertions of significant accounts and disclosures. If management is unable do so, then external auditors have no other choice than to exercise their own judgment in determining what work must be done to arrive at an opinion regarding the adequacy of internal control. Their judgment would include selecting the controls required to achieve financial assertion coverage as well as the nature (inquiry/observation, examination, or re-performance), timing (reporting periods from which samples will be selected), and extent (sample sizes) of the tests to be performed on those controls. In the current business environment, meeting professional obligations to third-party users of financial statements may impact an auditor’s testing decisions - better safe than sorry.
If an organization truly wants to benefit from AS 5, then it must adopt a systematic, objective approach to evaluating financial reporting and internal control risks and demonstrate management’s testing approach adequately addresses those risks.
CHALLENGES IMPACTING MANAGEMENT’S ABILITY TO EVAULUATE INTERNAL CONTROL OVER FINANCIAL REPORTING
Financial Statement Assertion Coverage
Financial statement assertions are nothing new - Sarbanes Oxley has merely changed them from implicit to overt declarations regarding the balances and disclosures reported by management. Management must now be able to articulate which assertions should be made about a particular account and what assertions each control provides coverage for. Inexperience with performing this task or unfamiliarity with the details or nuances of each control by the person performing the “Assertion Sourcing” task can result in four common problems:
1.Failure to document and evaluate all relevant assertions for each significant account. As a result, it becomes difficult if not impossible to ascertain whether all controls necessary to adequately report on an account are in place.
2.Redundant controls resulting in unnecessary testing due to the difficulty in evaluating the “many to many” relationships of risks, controls, and accounts.
3.Associating to an assertion the wrong controls, i.e. ones that won’t help meet the assertion. This situation can result from misunderstanding either the control or the assertion definition.
Claiming a control meets an assertion when it actually covers only a portion. For instance, the Completeness assertion is really composed of both Completeness and Cutoff; that is, all transactions are recorded in the proper period. A control like bank reconciliations allows management to assert proper cut-off, but not the completeness of the transactions, which should have been recorded in the General Ledger.
A SUGGESTED METHODOLOGY TO OVERCOME THESE ISSUES
Control Sourcing - Ensuring Assertion Coverage While Optimizing Controls
To overcome these issues, a control-optimization effort can be designed to identify duplicative, overlapping, or non-financial key controls for elimination from testing, as well as any areas where additional controls are needed or testing needs to be enhanced. However, while critical, the effort is not always simple. Effective control-optimization requires the ability to evaluate the “many to many” relationships of risks, controls, and accounts and evaluate which control would best enable management to make assertions about significant accounts. Control optimization also requires understanding which major classes of transactions in each cycle impact those accounts. Since many organizations utilize spreadsheets to capture the risk and control data attributes/elements, they often find it difficult to evaluate the assertion coverage obtained, because there are too many unique dimensions for Excel to deal with. Management should consider a true database structure to facilitate “Control Sourcing” to accounts and assertions in order to identify both duplication and control gaps via exposure by analysis.
Risk-Based Testing
Many organizations currently utilize a “one size fits all” approach to control testing. Control frequency determines sample sizes and the nature of the tests tends to skew towards examination and re-performance. Internal audit or independent management testers obtain evidence of the control and
Management should consider utilizing an approach which considers the combined effect of Financial Reporting risk (FR) (think Materiality and Impact) and Internal Control risk (IC) (think Likelihood), enabling them to assess the relative significance of controls and potential impact of control failures on Internal Control over Financial Reporting (ICFR) by calculating a numeric score based on objective risk criteria relevant to account balances, assertions, process and controls in a highly defined manner. No longer would all controls be equal. Instead, those whose failure could result in a more significant misstatement of the results of operations and required disclosures would receive more robust, objective and timely scrutiny.
The firm of AC Lordi Consulting has developed such a testing methodology and then taken it one step further. It leverages the information gained during the risk assessment, by recommending the nature (inquiry/observation, examination, re-performance), extent (sample sizes) and timing (period from which samples are drawn) for a test based on the ICFR score obtained for the related control.
For instance, an automated application control, in a well-controlled ERP environment, ensuring the summary of data compiled in the Accounts Receivable sub-ledger is completely and accurately recorded in the General Ledger is much less risky than the activities of an individual summarizing a list of invoices and then data-entering them to the General Ledger via a manual journal entry. Failure of either control would result in relatively the same financial reporting risk, but the process and control risk of the latter would be significantly higher, So the second control would receive a higher ICFR score based on the Process and controls IC risk contribution This higher score would portend a more severe approach to testing, likely resulting in a larger sample size, performed more often and much closer to the end of the reporting period.
Additionally, this methodology permits an organization to both spread the work more evenly over the year by testing the controls with lower (less risky) ICFR scores earlier in earlier quarters while ensuring management tests controls with higher ICFR scores closer to end of the reporting year and the testing is assigned to the more objective and independent Internal Audit function.
Instead of the usual two-phased approach to testing where the bulk of the testing is performed perhaps nine months into the year, with the remainder done shortly after year-end, and all controls have samples drawn from each of the two periods, management can schedule the tests to occur during less demanding timeframes and Internal Audit can integrate its testing with existing audit responsibilities.
CONCLUSION
Management should take a proactive position in helping frame the conversation regarding testing with the external auditors by providing sufficient documentation of a “top-down, risk-based” evaluation of the risks to providing timely and adequate financial results and disclosures to third-parties. Their approach should clearly show how the evaluation focused efforts on riskier activities and should aid management in achieving their desired goal of reducing compliance costs by clearly demonstrating to the external auditors familiarity with what could go wrong. Such an approach should also provide senior management and the Board of Directors with greater assurance that their duties have been properly discharged.
Management’s ability to evaluate its control environment is highly dependent on its ability to properly structure its risk assessment in a way that allows deep visibility into the nature of the framework. Knowing what controls can be omitted and what tests can be simplified amounts to understanding the importance associated to a control and the gaps that exist in meeting the assertions. But with the right methodology, data structures and reporting toolsets, this exercise becomes straightforward and highly cost-effective.
Copyright April 2008 Christopher D Coigne and John Dorsam
About
Ever since its first year of required compliance in 2004, Sarbanes-Oxley and Section 404 in particular has been criticized for the excessive cost and disruption it created for companies. The public debate about whether its been worth the effort has at times reached a fever pitch, as recently noted by the former Chairman of the SEC, Harvey Pitt[1], “As costs mounted, and auditors became defensive in their audits of internal control, a crescendo of criticism and despair arose, ultimately persuading the PCAOB and the SEC to revisit their prior guidance to make the beneficial purposes of the SOX 404 more obtainable, with lower costs and more focused efforts”. In this regard, certain statements from both the SEC and PCAOB December releases especially stand out[2]. At the same time, greater use of a risk based approach seems to reflect a return to the original principles of SOX and certainly of the COSO Framework.
[1] Compliance Week, March 2007 issue
[2] SEC Release # 33-8762, 34-54976 (12/15/06) and PCAOB Release # 2006-007 (12/19/06)
About the Author
Christopher D. Coigne CPA, CIA, CFE is the Senior Manager of Client Services and Product Development for BI International. For the past 5 years Chris has worked extensively with organizations seeking compliance with Sarbanes-Oxley (SOX). He has performed materiality planning and risk assessments, led facilitated control discussions, participated in client SOX Project Management Organizations, and overseen global control testing. Other projects have included managing outsourced Internal Audit activities, performing forensic and fraud investigations to aid in management’s deterrence and detection of fraud, and working to develop a web-based SOX and Internal Audit tool.
A graduate of Rowan University, Christopher’s experience includes public accounting financial audits, controllership in the insurance industry, internal audit management at Philadelphia-based ARAMARK, and consulting work for a variety of global organizations including McDonald’s, Sony, ING and Waste Management.
-
Archives
- August 2008 (2)
- July 2008 (2)
- May 2008 (1)
- April 2008 (3)
-
Categories
-
RSS
Entries RSS
Comments RSS
