Sarbanes Oxley- Internal Controls and Procedues Checklist

Most checklists were based on audit checklists which were based on AS-2 or AS-5 auditing standards. In general they do not work for the company assessment - but run up significant expense. See http://tinyurl.com/ybwp6tp for discussion.

You are taking the right approach. In fact focusing on just about anything other than a naive belief that there are "discrete" controls is appropriate. I have spent over 30 years doing workflows and am convinced "a control" is a continuous process performed by people - not a discrete activity. See http://tinyurl.com/ybwp6tp for discussion.

Jim Finn

Want to comment on and agree with posts by Scott Lane and Randy Rutledge, From my experience, both have hit on the issues.

From 2003 to 2007 I was consulting, largely on SOX404 projects. In the earlier days, it was not unusual to find clients that misgauged requirements resulting in "false starts" or they started late, creating a time crunch emergency.

SOX needs to be a risk based assessment. Companies need to undestand this, and evaluate the risks inherent to their business as it relates to their financial reporting. One of the challenges is to appropriately define and segregate what actually area financial reporting risks vs. operational and regulatory risks.

It is an effort to understand the alignment of people - processes - systems. I view this between how companies deal with transactional processing activites and events.

Typically companies capture most activities through daily transactional processing. Month-Quarter-Year End closings result in evaluating the transactions recorded, and adjusting estimates accordingly.

Events occur when significant changes occur. Typically are one-off, non-recurring issues. These could result in needing to change the underlying processes. Events are evaluated for their impact on the Balance Sheet valuation, adjustments likely result, or at least disclosure.

The referenced Small Company Internal Control document is a good listing of risks and areas to focus upon. I've recommended this before in this post.

Their is a logical process to complete the SOX 404 setup. Many of my clients thought they knew everything going on in their business, and learned things didn't necessarily happen the way they assumed or intended.

Randy

After reading the comments and concerns of those interested in this issue, I wish to make a "Summarizing" comment based on my last seven years experience with over a dozen SOX programs at separate companies.

1. Prior to 2007 there was no recognized useful guidance for a companies management to address "SOX Compliance". As a result most companies got overwhelmed with auditing checklists and control minutia by chasing the elusive " assertions" required by AS-2. Many companies have not recovered or cleaned up their excess AS-2 documentation yet. Even today, only individuals who are working these issues on a daily basis are familiar with the value of the interpretative guidance from the SEC or the application of a similar risk based approach focused on viewing financial reporting as a "report production process" that needs managements evaluation for quality control, and an assessment for confirmation of their control effectiveness.

2. COSO is a framework not a specification and it is effective at the highest conceptual level of the control environment. It is an outline that needs to be filled in by the company, but it is not a specification for the SOX section 404 compliance assessment requirement. If your SOX section 404 concepts are "pre 2007" you should reevaluate them in light of the most recent authoritative developments

3. The first practical steps to create a foundation for section 404 compliance are adequate documentation of the financial reporting process (workflow) procedures, and a risk based analysis and assessment in accordance with the SEC interpretative guidance.

Anything else is of a lessor authoritative level for a companies management, and may be biased by outside financial interests. The SEC is the best authoritative source for managements ICFR assessment as required by SOX section 404.

Jim Finn