Comments for SOX 404 Compliance

Comment on What is a “Key” Control? by L. Davis

L. Davis — Fri, 14 Nov 2008 19:46:59 +0000

Based on my own consulting experience, I can certainly validate Mr. Coigne’s observations. I think his point re: “what might be ‘key’ to a process may not necessarily be key when looking at the financial balance being evaluated …” may be particularly relevant to much of the recent scrutiny relevant to TPA’s (third party administrators) and the ever so basic “user controls” found in the SAS 70’s. I also think many auditors get lost in the details and forget the most basic criterion of everything we do: costs versus benefits.

Comment on C’mon and Ask Some Questions/Leave Comments by J

Mon, 29 Sep 2008 07:32:30 +0000

what is patent accounting and analysis?
I’ve done SOX quite a lot in my previous employment. How do I include this experience in my current resume?

Comment on Analyzing the cost-benefit of Sarbanes-Oxley by ccoigne

ccoigne — Mon, 07 Jul 2008 20:46:28 +0000

The FEI Survey results are interesting - 78% of finance executives felt the cost of compliance exceeded the benefits derived. In my consulting experience, the companies that truly benefitted from SOX were those leveraged the information gained during the compliance initiative to:

1. Gain a better understanding of the entire organization through robust documentation and not just Key Control identification. That understanding led to operational improvements as well as the intended benefits of strengthened financial reporting.
2. Involve management monitors and those who execute key controls in an ongoing process of communication with internal auditors and Senior management, not just a periodic testing exercise which they do not fully understand.
3. Gain real return on investment by demonstrating to lenders and insurers that the enhanced control environment is worthy of reductions in interest rates and premiums because it truly reduces the risk of losses and misstatements and demonstrates managements commitment to Enterprise Risk Management. My experience is in line with the study by Skaife/Collins/Kinney/Lefond mentioned above.

Comment on SOX 404 Compliance by Chris

Chris — Mon, 30 Jun 2008 16:19:38 +0000

Organizations identifying and testing a large number of Key Controls is usually the result of two mistakes:

1. Inclusion of operational controls as Key financial controls - i.e. the control cannot be mapped to an account/assertion intersection.

2. Over-reliance on detailed, transaction level process controls when Entity Level Controls, which occur less frequently and closer the external financial reporting cycle, can often provide the required degree of precsion for identifying material misstatements.

Comment on Evaluating Internal Control over Financial Reporting by Chris

Chris — Mon, 30 Jun 2008 16:04:21 +0000

The control sourcing exercise described is critical to achieving ROI on the work performed. The AS5 literature encourages an optimized control environment (i.e. reduced number of key controls) but most organizations utilizing Word and Excel struggle with finding an effective approach to objectively evaluate the intersection of accounts/assertions/controls as well as the overlapping/redundant controls that enable management to certify as to the effectiveness of the control environment.

Separately, and just as importantly, management must ensure that they don’t “over-optimize” the environment. Without the ability to link accounts/assertions/controls, manaagement may inadvertantly eliminate a control (maybe the only control) that enables them to ensure the financial statements are materially correct. Restatement of results is not acceptable!