Who tests first? 555
SOX-Migration last edited by
Does anyone know if the external auditors are allowed to start with their testing after the internal management has completed testing in one particular cycle first?. Or can they even test those cycles/processes where the management has not yet started testing?. And where is this question clearified?.
Thanks in advance.
kymike last edited by
There are no rules around who tests when.
From a practical perspective, you generally don’t want your external auditors testing before management has completed its evaluation of design and its own testing. If controls are found by management to be deficient, then the external auditors are wasting their time testing. Also, control weaknesses found by the external auditor which management did not find are an indicator of a material weakness in management’s assertion process.
The external auditors are to perform procedures that enable them to opine on management’s assessment of controls as well as perform enough work to form their own opinion as to the effectiveness of controls. It would be very difficult for the external auditor to form an opinion on management’s assertions if management has not yet completed it’s own work in this area.