Roll Forward Testing 2267



  • I work for a manufacturing company and we’re a non-accelerated filer. If controls tested in prior quarters passed, and the related processes haven’t changed, is it acceptable to forego testing in Q4 and just make a statement attesting to the operating effectiveness of these controls based on the previous test results?
    I read AS5, which lists the circumstances under which roll forward testing can be applied, but I thought there was a requirement that testing of key controls has to occur within 60 days prior to fiscal year end.



  • According to AS5, tests must be closer to year-end. So, I would ask for my independent auditor and align with them.%0AIn my case, our auditor asked for a Q4 testing (at least 25% of our sample).



  • I thought the purpose of roll forward testing was to reduce testing efforts, potentially up to the point where inquiry alone would suffice, for those areas that have a good reporting history (i.e, no, or few, exceptions) and where it can be dermined that processes relating to ICFR have not changed since interim testing was performed?
    Granted, management’s approach to ICFR does not have to be in line with what the EA’s do, but I was curious how others are using roll forward testing to reduce SOX costs.
    Thanks.



  • There must always be some form of assurance gathered in Q4 but given that we are supposed to be applying a risk based approach to our SOX testing then the extent of the assurance needed in Q4 will depend on your own risk assessment for each process.%0AFor example if you have a process that you consider low risk you could either:%0A1. Test per your total sample minus 1 prior to Q4 leaving a sample of one to test in Q4. %0A2. Test 100% of your sample prior to Q4 and then undertake some inquiry work in Q4 to confirm that nothing has changed.%0AThe approach I took this year for low risk processes was to undertake a full walkthrough (effectively a sample size of 1) and ensure that the process operates as described. In Q4 I then followed this up with inquiry and observation to satisfy myself that nothing had changed.%0AFor high risk process I think the only testing you can undertake prior to Q4 is the design of the process itself. The testing of the operation of the controls must all be tested in Q4 and any testing prior to this cannot be relied upon. Given that these are more often or not year end controls then you can only test in Q4.%0AShould you also have any medium risk processes then you will need to have some middle ground approach where I would probably apply something along the lines of 25% testing in Q4.



  • There must always be some form of assurance gathered in Q4 but given that we are supposed to be applying a risk based approach to our SOX testing then the extent of the assurance needed in Q4 will depend on your own risk assessment for each process.%0AFor example if you have a process that you consider low risk you could either:%0A1. Test per your total sample minus 1 prior to Q4 leaving a sample of one to test in Q4. %0A2. Test 100% of your sample prior to Q4 and then undertake some inquiry work in Q4 to confirm that nothing has changed.%0AThe approach I took this year for low risk processes was to undertake a full walkthrough (effectively a sample size of 1) and ensure that the process operates as described. In Q4 I then followed this up with inquiry and observation to satisfy myself that nothing had changed.%0AFor high risk process I think the only testing you can undertake prior to Q4 is the design of the process itself. The testing of the operation of the controls must all be tested in Q4 and any testing prior to this cannot be relied upon. Given that these are more often or not year end controls then you can only test in Q4.%0AShould you also have any medium risk processes then you will need to have some middle ground approach where I would probably apply something along the lines of 25% testing in Q4. %0AWe have more or less same approach between Q2-Q4. %0AThe idea of roll forward testing was not to reduce cost but to derive more assurance out of the testing that was not done close to the year end. No testing in Q4 is not advisable for high and medium risk controls. Here is a middle ground which I have seen:%0A1. Low risk - Inquiry in Q4 as no testing was done in Q4.%0A2. Medium risk - 1 sample in Q4%0A3. High risk - More samples in Q4. Design effectiveness tested early in the year say Q4.%0ACalvin


Log in to reply