Timing of testing during the year 640
SOX-Migration last edited by
We successfully completed our first year and 1st quarter, and now we are knee deep in planning 2005 testing. Part of our strategy this year is to get as much testing done prior to the 4th quarter, and use the 4th quarter only for any remediations. However, our auditors are telling us that, for each of our processes, part of our testing sample needs to be in the 4th quarter (e.g. if we are testing a sample of 40 for a daily control, leave 5 open to cover the 4th quarter). I believe that is ridiculous, and that the 4th quarter certification by management to roll controls forward should be sufficient.
Our auditors said the other option is to confirm that the control is still working (quarterly certification process) AND to do a walkthrough in the 4th quarter. I am contending that this is something THEY need to do in the 4th quarter to combine with their audit over the financial statements, but not something necessary for management.
Has anyone heard this from their auditors? Is there any ammunition out there that I can use to dispute this? I’ve search the PCAOB AS2 rules and Q_and_A but can’t find anything specific related to management, and, of course, the SOX Act itself doesn’t help.
Chris last edited by
Our approach is to risk rate all processes low through High. High risk processes will have ‘roll forward’ testing performed during the last quarter (the 5 more sample test process).
Low and medium processes are ‘less likely’ to have a material weakness so our testing will be strong but completed between March and September and not touched again except in the case of a major control change or to retest after remediation as for the rest we will rely on 302 stating that nothing significant has changed.
Remember only your auditors need perform walkthrough testing. You can if you want (it is good to confirm your processes) but you need to do substantive, observation etc.
MarkNYCCPA last edited by
My year-end is June 2005. We will probably working with our auditors KPMG until July/August to complete our 1st SOX audit – AND you’re tell me I have to have 1st quarter testing done before 09/30/05 ???