Evidence of effective reviews 550



  • Hi All:
    I’m hoping someone can give me some quick guidance so I don’t have to dig through PCAOB information. I am on an internal audit team that is testing controls for 404. My boss and I were debating what is most likely required to demonstrate evidence of an effective review control.
    Our company relies on a number of financial statement reviews, as well as reviews of other types of reports. We have tested these reviews, and now are in the process of reviewing the work. My boss says as long as the process owner has addressed the required items with some type of explanation, we are not under the burden of proving that the explanations are valid, only that there is evidence that a review took place.
    I, on the other hand, think we are required to show evidence of an ‘effective’ review, and test the validity of those explanations. Has anyone had experience with this? My life will certainly be easier if we only have to verify that explanations are documented, and not valid. I just don’t know if that’s the case.
    Thanks in advance.



  • I don’t think you will find anything in the PCAOB guidelines that is this specific.
    This is really one of those gray areas. I am testing only that there is evidence of the reivew. But, I also have controls relating to the competency of the accounting personnel.



  • Thanks cherylcato. I like the idea of having the competent personnel controls. Unfortunately, the call on which controls we rely on and test is not that of my internal audit team, but of management. I wouldn’t mind proposing the idea though. Thanks again.



  • This is really one of those gray areas. I am testing only that there is evidence of the reivew.
    It is not a gray area at all, perhaps there is the use of professional judgement, but that’s not the same thing. SOX is a principles based Act it doesn’t have all the answers and expects managements (and auditors) to use judgment about what is sufficient.
    For what it’s worth I wouldn’t regard it as sufficient to just check whether a review took place. In determining design effectiveness of the control you have to consider whether it sufficiently meets the financial statements assertions - to do this you need consider the quality of the control. In assessing operating effectiveness whilst you wouldn’t need to verufy every aspect of the control you still need to get enough evidence that the control is being performed properly. You may get this through reperformance or, alternatively, observation and enquiry.
    But, I also have controls relating to the competency of the accounting personnel
    8O Never seen that before - and if there is a control deficiency are they fired? :lol:



  • Denis, when I said I was testing only that the review was made - perhaps I wasn’t perfectly clear. For example, if the control states ‘Management reviews bank reconciliations’ then I would ONLY test for evidence of that review, ie, a manager’s signature on the reconciliation.
    However, for the control that states ‘Bank reconciliations are performed monthly’, then I would test that the rec is being performed accurately.
    Two different controls…two different tests.



  • Denis, when I said I was testing only that the review was made - perhaps I wasn’t perfectly clear. For example, if the control states ‘Management reviews bank reconciliations’ then I would ONLY test for evidence of that review, ie, a manager’s signature on the reconciliation.
    However, for the control that states ‘Bank reconciliations are performed monthly’, then I would test that the rec is being performed accurately.
    Two different controls…two different tests.
    Fair enough. To be honest I wouldn’t have these as seperate controls, in evaluating the bank reconciliation I would be looking for evidence of review as well as follow up of reconciling items


Log in to reply