What is the date scope for the SOX external audit? 170



  • What is the date scope for the SOX external audit?
    Is it the timeframe period January 1, 2004 through fiscal year-to-date?
    My concern is; implementation of SOX compliant policies and procedures were not fully effective January 1, 2004 and have become more so during the year. So, if they audit and find gaps during the first part of this timeframe it may not accurately represent current controls.
    Thanks in advance.



  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • This post is deleted!


  • The internal controls assertion is as of the fiscal year end. Controls are rested throughout the year to ensure that they have been operating effectively. New controls implemented would nt be tested prior to implementation, but do need to be in place for a reasonable period of time prior to year end in order to allow for testing of effectiveness.



  • Kymike, Thank you.
    The subjective factor is, what is a ‘reasonable period of time prior to yearend’? I’m thinking 90 days (one quarter). Is there a rule of thumb or a general practice based on experience that defines the number of days that equals a reasonable period of time? Thanks in advance.



  • Our auditors want to see most controls executed at least twice consecutively prior to asserting that they are effective. For quarterly controls (10Q-related) this would be the third and fourth quarters. For monthly controls, this would be at least the two months prior to the last month of the year (Oct-Nov for a calendar filer).
    We are testing throughout the year on all significant controls and retesting in the fourth quarter those controls where remediation was necessary.



  • It also depends on how critical the identified control gap is. We have a new annual control which we’ll only be able to test once, and a quarterly to be completed mid-october to be tested/evidenced once.
    I’m curious as to what the impact would be if a monthly critical control is only implemented during December 3rd.



  • Our auditors have indicated that a monthly critical control not implemented until the last month of the year will not be considered effective by them for the current year and will be deemed a deficiency. Of course, the impact on the report will be based on all controls considered, not just one control.



  • Just an update on the external audit intrepretation for our audit.
    The audit is complete. Basically, two types of issues: Financial - policy, control and practice not in place for the entire year (January 1, 2004) and SOx deficient - we have until November 1, 2004 to have in place. This gives us 60 days (January 1, 2005) to demonstrate the effectiveness.
    j2


Log in to reply