Outsourcing a significant function 2331

  • We lost our tax manager in Q4 of 2007 and have outsourced the tax function to an external accounting firm. This firm is stating that we cannot use their reviews/evaluations as a control as 404 prohibits it and that company management will need to sign off for 404 purposes. The reason we outsourced in the first place was because we did not possess the necessary expertise to perform the year end tax work. We’re not asking them to assess the design or operating effectiveness of the controls, only to perform the work that the former manager would have been responsible for, and then use that work as evidence in the course of testing the controls.
    I am reading through the Sarbanes-Oxley Act and AS 5 trying to locate the provision the accounting firm is referencing and am not having a lot of success. Is there specific language in the act that would prohibit us from using the accounting firms review, evaluation, and sign off as a 404 control?

  • I think the answer here is ‘it depends’, personally I don’t think there is much extra that you need to do to get to your SOX sign-off on this.
    Fundamentally you should be able to rely on the of 3rd party experts - otherwise what are you paying them for :roll: They may be right to state that you can’t just take their output and say ‘that’s my 404 control’ but you should be able to wrap your own process around that to get to a place where that is effectively what you’re doing.
    Check out some of the posts about using the worlk of actuaries which touches on some of the same issues.

  • I’ll add to Denis’ comments. The level of controls testing or reliance will depend on the type of work that the outsourced firm is doing for you. Are they just completing tax returns and calculating tax provisions or are they providing some transactional processing for you (paying proprty taxes)? If it is just providing calculations, then you probably can count them as similar to an actuary (providing expert services versus processing of transactions) and ensure that you have controls over the completeness and accuracy of data provided to them and over recording the end results of the work (tax provision). If they are providign transactional processing, then they are more like a true service provider where SAS 70 reports would be used to rely on processing controls. In the absence of a SAS 70, you would need to consider testing of their internal controls.

Log in to reply