Roll forward testing

[Erika]

Hi

Questions on roll forward testing.

[1] What is roll forward testing? Does it cover only testing of operating effectiveness for the last quarter or testing of 'amended' controls after the SOX audit whereby deficiencies are raised & required to be 'fixed' or 'amended', or both?

[2] What exactly is roll forward testing trying to achieve apart from supporting the management assertion of controls for the last quarter of the year?

[3] If SOX audit by external auditors is not completed till end of November and therefore organization do not know what their deficiencies are, do we still need to perform roll forward testing supposedly if there's no change to the process & your testing of samples were up to September?

[4] Is it required to perform roll forward testing on ALL controls or can we test on those really key controls?

Appreciate all your thoughts on this!

Erika

[angie]

Erika,

In this subject, in fact, it all depends on the wish and objectives of the headquarters, in concordance with the external auditors. That said it all depends on how confident is local management on the control environment, comunication and risk assessment controls. Then, I believe we can go into the control activities. The size of the samples and the type of controls depends on that first step.

In previous experiences, we launched a quarterly representation letter where controllers/ financial directors stated compliance with internal policy (or not) and the existence of certain controls that was preventing the SOX team to perform quarterly roll forwards and testings. And this with the agreement of the external auditors of course.

Once a year, close to year end, controls were tested keeping the significance and materiality in mind.

That is my contribution

[auditorofsox]

can anybody pls tell me is what exactly roll forward testing is?

[John_Maleckar_CPA]

There are generally two types roll-forward audit procedures:
1. substantive tests of accounts and balances, and
2. tests of key financial controls.

The first type (substantive tests) refers to testing and account balance at an interim date and then testing the transactions between the interim date and the date of the financial statements. The most common accounts tested and then rolled forward to year end are accounts reveiveable (and the allowance for doubtful accounts) and inventory. See abrema.net/abrema/anal_proc_g.html for a good (textbook) definition.

The second type--SOx/control testing--is similar in the sense that controls are tested prior to the "as-of" date of management's assessment over the financial controls, and then "rolled forward" to the "as of" date. The rolling forward tests can include "inquiry," "observation," "inspection," and "walk through".

Basically, once a control is found to be effective (at interim), an auditor can perform as much testing as they need to assure (themselves) that the control is still effective, without having to completely re-test. The roll-forward tests don't have to include all procedures that were performed at interim (so that the audit work can be spread throughout the year which can be more efficient (i.e. less expensive)).

For a full discussion go to PCAOB's AS-2 ( pcaob.org/Rules/Rules_of_the_Board/Auditing_Standard_2.pdf page 246 "Examples of Extent-of-Testing Decisions" ) and the PCAOB's Staff Question and Answer #51 ( pcaob.org/Standards/Staff_Questions_and_Answers/2005/05-16.pdf )

Side note: There are times that people refer to "rolling forward" account balances. In this case, the ending balance from year 20x1 is rolled forward as the beginning balance of the account in year 20x2.

Hope this helps.

[auditorofsox]

Thanks for the information..

Definitely it helped...

[mvedula]

Erika:

As John Malekar explains the Roll-Forward Testing" is key within the Sarbanes Perspective.

Practical explanation of Roll-Forward is - TESTING that would be conducted at a later point in the Audit Year that bridges the timing gap between the prior testing, but before the conclusion of the final audits for the financial year.

Specific to Sarbanes - the Auditors / Management need to attest effectiveness of the controls - for the entire 12 month period. Let us say that Company XYZ ends its financial year 12/31. If the audit teams complete majority of the testing - say by the end of Q2. Irrespective of the test outcome - Auditors need to perform additional testing towards the end of the year mainly to assure that the Operational Effectiveness of the controls - still remain optimal and that if any additional changes to the control environment since last audit- in this case from Q2.

Well planned quarterly audits and constant monitoring of the control environment for changes/ continued effectiveness would greatly minimizes the need for Roll-Forward testing and last minute demands from the external auditors.
_________________
Madhav Vedula CISA
Sr.Internal Audit Consultant
Madhav_vedula@yahoo.com

[auditorofsox]

mvedula:

thank you for adding some further useful comments....

you guys are really rose of this garden...

[md908]

Can someone confirm for me that basic steps in a roll forward?

For a Balance Sheet Account, is it simply ... Beginning Balance + Debits - Credits = Ending Balance?

The ending balance would then be compared to the balance sheet amount as of the tested date for verification?

Thanks,

[War1lock]

We have both Internal and external Audits, I am curious as to why we do yearend testing and then still need to supply evidence for a roll forward questioner, my VP, Senior Operations Director and myself as Change Management Manager state that there have been no changes since yearend testing, the external auditors also sends us a roll forward questioner asking the same but do not require another round of samples since yearend testing has essentially just completed all the way through mid-December, and we are fairly confident that there have been no changes for the last two or three weeks. Yet our internal audit still ask for this, we are a company that was bought by another company, we are under that umbrella..can they just say do it no matter what?? Any policies or guidelines on this?

Thanks