Level of Detail on SoX Narratives 2670



  • What kind of information/changes needs to be included in the SoX narratives and how much detail does it need to be in?
    We are having process owners update their own SoX narratives and this is the type of question that we get. How do we answer this?



  • We require any changes in processes or controls to be updated in the process narratives. If the process narratives are too detailed, then the updates likely are going to be too detailed as well.
    When we adopted SOX, our narratives were too detailed and we identified too many controls. Updates were difficult to do. We went through an ‘optimization’ process whereby we took a top-down approach to conrtols, eliminated controls that provided duplicate coverage or were at too low of a level of detail and ended up with less than half of our original controls. We then updated our narratives to correspond with our reduced number of controls. These are now much easier to update since it would take a dramatic change in how we perform these (fewer) controls to have an impact on our overall control set and the related narratives. We also do not include names of people performing controls in the body of our narratives, only position titles. This helps us in not having to do as many search and replacements when there is staff turnover.



  • You might also compliment kymike’s great suggestions with Visio diagrams where practical to help illustrate on a macro level. This might make it easier when working with external SOX auditors who are helping affirm controls, as a 'picture is often worth a ‘000 words’



  • You might also compliment kymike’s great suggestions with Visio diagrams where practical to help illustrate on a macro level. This might make it easier when working with external SOX auditors who are helping affirm controls, as a 'picture is often worth a ‘000 words’
    Aw shucks, you don’t need to do that.
    However, you might complement the narrative with flowcharts, but from experience, this is more of an art than a science and can get frustrating or ugly if you are not very experienced with Visio. Also, Visio is not a standard MS Office product and can get expensive if you need to buy a lot of copies for your team to use.



  • All true. If we are low rent then PowerPoint can be passable (if fiddly) for flowcharting


Log in to reply