How deep does quarterly testing have to be?

[Guest]

This is my understanding of the requirements for quarterly SOX testing. Perhaps someone can add to/correct it? I think it's light, basically asking the control owners if there have been any changes (some companies automate this via emails). I'm working with auditors that test to a level making it a 'mini-sox'. How much is needed?

The requirements for quarterly SOX testing are light, it is not a partial SOX audit, it is merely a statement about changes to the controls in place, so that management is kept informed between annual SOX testing.

After reading on the matter, I found that that the requirements can be reduced to three questions, summarized as:
1. Any changes to control?
2. Any problems in the financials due to this control?
3. Does the change have a material affect?

These questions can be answered with inquiry and observation. For controls that have not changed, further testing, gathering and validating logs, sampling of file permissions, etc. are done during the annual SOX work, and not quarterly.


From the SEC (their web site, I believe):
"require a company's management, with the participation of the principal executive and financial officers, to evaluate any change in the company's internal control over financial reporting that occurred during a fiscal quarter that has materially affected, or is reasonably likely to materially affect, the company's internal control over financial reporting."

In the attached pdf, it notes:

Auditor Evaluation Responsibilities
PCAOB Auditing Standard No. 2 discusses the external auditor’s responsibilities in regards to 302. In particular, it states:

The auditor’s responsibility as it relates to management’s quarterly certifications on internal control over financial reporting is different from the auditor’s responsibility as it relates to management’s annual assessment of internal control over financial reporting. The auditor should perform limited procedures quarterly to provide a basis for determining whether he or she has become aware of any material modifications that, in the auditor’s judgment, should be made to the disclosures about changes in internal control over financial reporting in order for the certifications to be accurate and to comply with the requirements of Section 302 of the Act.

To fulfill this responsibility, the auditor should perform, on a quarterly basis, the following procedures:
• Inquire of management about significant changes in the design or operation of internal control over financial reporting as it relates to the preparation of annual as well as interim financial information that could have occurred subsequent to the preceding annual audit or prior review of interim financial information; • Evaluate the implications of misstatements identified by the auditor as part of the auditor’s required review of interim financial information (See AU sec. 722, Interim Financial
Information) as it relates to effective internal control over financial reporting; and • Determine, through a combination of observation and inquiry, whether any change in internal control over financial reporting has materially affected, or is reasonably likely to materially affect, the company’s internal control over financial reporting.

[Denis]

My own interpretation is that the quarterly requirement is limited. I believe it would be justified for management to look at it's processes and question whether there have been any significant changes (to systems, personnel, transaction types, etc) and whether they are satisfied that the controls continue to operate effectively and do very little testing if they are satisfied.

However, some companies are choosing to spread their 404 testing throughout the year - perhaps as part of quarter/month-end processes - in which circumstances you can, more or less, satisfy 302 at the same time.

[kymike]

Unless management is testing all key controls every quarter, I don't think that the quarterly testing would satisfy the requirements of 302. 404 is a subset of 302. Management needs to have a process in place to identify any significant changes in its internal control environment for purposes of the 302 certification. Testing may be a part of that process.

[Denis]