Testing controls vs Implementing a new system 141



  • Hello,
    I have an issue regarding SoX:
    Our company is planning to implement new ERP software in Q4 and this will obviously have an impact on our controls as these will be (partly) replaced or improved. Our external auditor states that they need 2 quarters to test these new controls to give a qualification, in reality we only have one quarter as we are implementing the system in Q4.
    Does this mean that we have to postpone our implementation to be able to comply with SoX?
    I would think that it can never be the intention of SoX to have such a large impact on the actual operations, the costs would completely outweigh the benefits.
    Does anyone have more information/experience regarding this issue?
    Thanks in advance,
    Hielke



  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • A basic rule of thumb is that you need a policy / procedure / system to be in place at least one quarter before it is audited.
    You need to have used the system long enough to accumulate documenation to show the controls are effective.
    It takes about one quarter to test an ARP before you introduce it into yoru producion environment. That includes custimization of the product for your company, sanity testing, functional testing, UAT testing, capacity and performance testing, intergration testing etc.
    I think there is your two quarters time period.
    With a system such as an ARP which is Critical in finacial reporting there is little wiggle room.
    Also, since SOX is so new what your external auditor tells you is basically the law.
    If you don’t like what they tell you then you can go in search of another accounting firm that tellls you something you like better, but to ignore what they tell you and impliment an ARP system now would not be appropriate.



  • Hielke,
    My experience with our externals is that they will not attest to anything less than 6 months of time for testing of a key control (E-and-Y). I don’t think it was the intention of SOX to try and delay implementation of new processes, but your old processes should have been in compliance too. You can begin your new process and test next year, but the auditors will probably attest to your current procedures and test the new processes for fiscal year 2005. This is a really hard call though and I would discuss this further with your externals before making any assumptions.



  • Sox intent was to ensure to ensure as much as possible the accuracy of your financial reporting…
    An ERP is the heart of financial reporting.
    The extent of use a policy / procedure needs to go through depend on many factors including the extent of which your controls are automated and even which auditor you ask.
    PWC and Jefferson Wells have told us we need 3 months lifecycle into our procedures / policies before they will attest.
    The same auditors might tell you 6 months for a variety of reasons.
    Your best bet is send the effort and really get to understand what and why your auditors will require of you.
    :lol:
    I know it dosen’t help much …but we are all in the same boat.



  • Hi All,
    I think we are all missing one thing. you need to scope and size your work. Just because you are implementing an ERP it is not the end of the world. (not a good idea but not the end of the world).
    The rule of thumb to demonstrate that controls are working for two cycles before they are tested. For example, a monthly cycle count would require two months after the controls are implemented b4 the accountants can attest to it. Big 4s are saying 6 months because if it is a quarterly key control then you will have to allow two quarters before testing.
    What i have recommended to my clients are to change the key controls to monthly if they are strapped for time. You will find most controls are performed monthly but adjustments may be made quarterly.
    Hope this helps.
    Tristan.


Log in to reply