SOX 404 Compliance

It still surprises me that, after nearly 5 years of SOX history, many organizations I encounter still struggle with the question - “what is a key control?”.

Sarbanes Oxley requires the materially accurate reporting of financial results for publicly traded organizations.  Consequently, the easiest way to identify which controls are key is to ask yourself - ”does this control impact an account in the financial statements or a disclosure in the footnotes?”.  For many of the controls identified by my clients the answer is “no”.

As an example, let’s examine a control which obviously impacts the financial statements - the bank reconciliation.  When an individual performs the monthly bank reconciliation, they are utilizing an independent, third-party provided document to ensure the existence and accuracy (and probably completeness and cut-off) of transactions related to the Cash account.  There is little doubt that every organization executes this control and that it is essential to the accuracy of reported financial results.

As a counterpoint, let’s consider a control encountered time and again in the Human Resources or Payroll cycles of large organizations throughout the U.S - “Employee benefit requests and transactions are appropriately reviewed, approved, and validated to support”.  In my estimation, this is not a key control for SOX purposes.

Although many have argued the point with me, I submit the following:

• How material is any amount related to these types of transactions at any point in time, especially at a quarter end?
• For balance sheet-related escrow/liability accounts, isn’t the periodic account reconciliation sufficient?
• For income statement-related expense accounts (employer 401k, employer portion of health insurance, etc) any variance from actual would likely be identified during a fluctuation analysis - current to prior or current to budget or both.

My point is this - what might be “key” to a process may not necessarily be key when looking at the financial balance being evaluated because multiple cycles/processes likely impact that balance and a control in another process may be sufficient for management to make assertions about that balance.  In short, sourcing the account/assertion intersection from the top-down to a sufficiently robust and precise control should enable management to avoid testing controls that may be important to a process, but less so for getting the reported balance materially correct.