Control frequency sample size 1640

  • Hi Chhaava

  • Lets say you have 30 sites that gives you coverage of 65-70%…however 1 of these sites is substantially larger than all the others…statistically, your population size is skewed by the one site however everyone is saying test it 30 times if it is a daily transaction…why wouldnt you determine the population size across all the sites and obtain a random sample which would inherently require you to test more at the larger location than some of the smaller ones…the statistics dont work for me based on an arbitrary number of X when the poplution may be very small or quite large.

  • Hi,
    it looks like you are trying to test a control once rather than in each site. You need to make sure that this rationale is valid in the first place. It is only allowable if the diff locations are all part of one signficant location/entity ( in which case, you can take all samples from the larger location).
    Otherwise, you will need to testyour controls separately in each location. In this case, if the total transactions incurred are less than minimum sample size, you need to test all transactions that occurred during the period.[/code]

  • EMM,
    Thanks for your reply and reasoning too. Although an earlier question was answered previously, the new question recently posted and your reply/feedback are helpful now.
    One learns something new every day and it always insightful to read other posts and insight from SOX professionals.
    Kind Regards,

  • Manual - Periodic
    Annual - 1
    Quarterly - 2
    Monthly - 3
    Weekly - 5
    Daily - 25
    I’m curious, what do these numbers represent?

  • Sample sizes.

  • Going back to the discussion around ‘As needed’ how about using ‘On Trigger’ for controls that are executed on a trigger event that has an irregular frequency i.e. when an employee is hired.
    I would aslo use Transactional as shorthand for multiple times per day.

  • It has been a long time since I was in the audit world, so this is probably a basic question: When we do interim testing in Q3, do we test the full sample size as prescribed based on the control frequency? Or can we ‘save’ some samples for the later roll-forward testing?

  • you can save.

  • We do the majority of our testing in Q3 and then small samples in Q4 for roll-forward testing. Low-risk areas have all samples testeed in Q3 with roll-forward testing consisting of an inquiry as to whether the control is still operating as it was when tested.

  • It would also be a valid approach to do, say, all you testing in 3 quarters and then roll forward based on enquiry - in particular looking for a trigger event that would suggest that the process needs to be looked at again e.g. change in process, people or systems; evidence of errors; fraud or other irregulaity; etc.
    I prefer to split testing evenly over 4 quarters as I think this is more conducive to embedding controls.

  • Going back to the discussion on ‘sample sizes’: does anyone kwon what the big 4 sample size means in terms of:

    • Sampling error
    • Population size
    • Confidence level
    • Expected error rate
      Sample Sizes:
      Annual = 1
      Quarterly = 2
      Monthly = 2 to 5
      Weekly = 5, 10, 15
      Daily = 20, 30, 40
      Many times per day = 25, 30, 45, 60

  • What do you see as the frequency of the control that JEs are reviewed? Theoretically, JEs can be made and reviewed multiple times a day, but can we make an argument that holistically, all JEs within a month are for the F/S for that month, and hence the activity (JEs being booked and reviewed) is a monthly activity?

  • We look at JEs as monthly activities and test using sample sizes for monthly controls. While recorded throughout the month, they really are not transactional in nature and I don’t feel they should be tested as such.

  • Once you consider JEs as monthly activities, you will need to test the holy month (all journal entries…), in order to do not make sample from another sample. I would prefer to test considering as multiple times a day (as we have more than thousand entries every year).

  • I stand corrected. We do treat them as multiple times per day and select our sample size based on that. We have also started to include only the most significant of the entries in our test pool as we could never have a material misstatement come from small dollar entries.
    Our multiple times per day sample size is 35. We test across all periods up to the test date.

  • I stand corrected. We do treat them as multiple times per day and select our sample size based on that. We have also started to include only the most significant of the entries in our test pool as we could never have a material misstatement come from small dollar entries.
    Our multiple times per day sample size is 35. We test across all periods up to the test date.
    I just inherited the SOX overseeing function at a new company, and saw that this is viewed as a quarterly activity (our sample size for quarterly and monthly are the same). A few years ago when I had limited exposure to SOX at another company, the approach on JEs was also ‘multiple times a day’. Now before I go ask my predecessor about this, I just wanted to get some feedback to see what is done out there.
    Do you think AS5 gives us any relief in this respect?

  • The only thing that AS5 will help on is to direct us to focus on those items that could have a material impact on the FS. That is why we are testing only the larger-dollar JEs for proper authorization / support. Also, a lot of the testing of JEs will depend on your transactional systems in place. If you rely heavily on spreadsheets to track transactional activity using JEs to record activity to the GL, then you should test JEs heavier than if you have good transactional systems and use JEs to primarily record corrections, accruals, etc.
    You may also find that you have a tight rein on JEs via online approvals prior to posting or that you complete account reconciliations prior to issuing your financials. Both of these would allow to to place some reliance on them and lowere your JE risk and, consequently, your sample size.
    Of course, there is no one-size-fits-all answer for most control questions other than ‘it depends’, referring to how your individual control environment is set up.

  • I got some answers from my predecessor: In the past few years, we have been doing a ‘sample within sample’ approach for JEs. Basically, we consider this to be a monthly activity and select the months to be tested (2 months to be exact), and then within those 2 months, we get to select 5 JEs each to test. This seems very aggressive, but I do not want to bring this up with the auditors – why wake a sleeping tiger? Apparently the auditors have been OK with the level of our testing in prior years. And if anything, AS5 will enhance that mentality (consideration of knowledge obtained during previous audits), right?
    I know that at the end of the day, the testings that management does supports management’s assertion on internal controls and therefore management can do only however much it wants to make the CEO/CFO comfortable to sign the certifications.
    Any thoughts?

  • So, you are testing 30 JE’s per year. THat is reasonable. I would suggest that you focus in on testing of those JEs that could ahve a material impact on your FS if in error. We are only including in our poplulation to sample from those JEs greater than USD500M. We are still testing 30-35 JE’s, but from a smaller population, more focused on where the true risk exists.

Log in to reply