Documentation _and_amp; Controls 1860
-
Hi,
We are a large multinational entity and are in the process of conducting our year 1 controls testing.
I am unclear on the level of documentation we are required to retain on each test performed. In some business units the testers have retained a screen print/p’copy of authorisation etc for every detail of a test. My thought is that this is excessive and that as long as the details of the invoice viewed and for example the person authorising something is sufficient without building up a large pile of photocopying.
Any guidance or links to s404 policy would be greatly appreciated.
Thanks
-
The documentation level that you need to maintan should be in Compliance with Audit Standard 3 (AS 3). A copy fof this standard can be found on the www. pcaob.org website.
Essentially, you need to supply sufficient evidence and detail from your working papers to allow an experienced auditor to reperform the work.
-
Thanks EMM, is a big help and I think that as long as the documentation of our testing includes sufficient detail to reperform our work then we have met the requirements of AS3 - can I give you a ‘for instance’…
If you are testing that overtime is authorised and you record all of the details such as payroll week, employee, date of overtime, amount of overtime and who authorised it. Then there would be no need to take copies of all of the paperwork and retain these in a seperate testing file?
How about for key account reconciliations - if we record when a bank rec was performed, and that we have seen it agrees to the accounts etc there is no need to retain copies of the bank rec in the control testing files?
Thanks again in advance.
-
As long as the reports you have examined are clearly referenced and obtainable again, yes, this should be ok.
Bear in mind though, that if there is particular manual evidence you are trying to confirm (e.g approval and review of reconciliations are evidenced by manager signature and date), then I would recommend that you actually photocopy the document you have looked at. This prevents backdating and signatures on reports AFTER they have been identified under SOX testing as deficient. Therefore, if in doubt, it is a safer option to photocopy all documents reviewed.
-
Cheers EMM, I take your point and where we find deficiencies I agree that the safest option would be to photocopy as evidence.
Thanks very much for your advice