Implementing a SOX 404 program

Scenario

You are a SOX Audit Manager that owns two projects. You want to ensure that the terminology displayed in both SOX projects aligns with your organization's preferred lexicon.

Process

Help topic Customizing terms, fields, and notifications

You navigate to the Sarbanes-Oxley Review project type, and configure the following terms on each tab:

Result

The custom terms will be applied to the projects you create and associate with the Sarbanes-Oxley Review project type.

Scenario

To begin the process of centralizing your SOX documentation, you create two projects:

• Canada - SOX Review 2018
• Brazil - SOX Review 2018

Recently, you recognized that similar risks and controls can apply to both projects. To provide a starting point for building out your projects, you create a project from a project template called Sarbanes-Oxley (SOX) Audit Template (COSO 2013 Framework). You want to use this template to create a single set of risks and controls that can be used in both projects.

Process

Help topics

• Creating projects
• Using project templates
• Overview of Frameworks
• Cloning and importing objectives

You create a new framework called SOX Process Control Framework. Then, you import the objectives (containing risks and controls) from the project template to the framework. Finally, you import the objectives from the framework into each project.

Result

The objectives, risks, and controls in the framework are linked to the objectives, risks, and controls in the projects.

You can now update the projects as needed, optionally apply those updates back up to the framework, and also ensure that updates made in the framework propagate to the appropriate projects by syncing projects with frameworks.

Scenario

Your organization is comprised of different departments, regions, and locations. You want to be able to report on internal controls from different cross-sections of the business, and allow stakeholders at all levels of the organization to obtain the information they require.

Process

Help topic Setting up entity tagging

Under Manage Entities, you model your business structure based on the departments, regions, and locations that are applicable to both projects:

• Canada - SOX Review 2018
• Brazil - SOX Review 2018

Result

You can now tag projects, significant objectives, risks, controls, and deficiencies to the relevant contextual data points and enable risk and control reporting on those dimensions.

Scenario

You are responsible for preparing and consolidating all planning documentation related to the Canada - SOX Review 2018 project. You need to capture this information in the project so that it can be referenced at a later date.

Process

Help topic Planning projects

First, you navigate to the Planning page, and begin to define the background, purpose, and scope of the project. Then, you add supporting documentation using the Planning Files page:

Result

Planning information is captured:

• Background In 2002, the SOX Act legislation ushered in a renewed focus on corporate compliance by requiring that organizations provide quarterly and annual reports certifying the accuracy of their financial statements. The SOX Act was designed to increase transparency in financial reporting and standardize a system of internal checks and balances. SOX Section 404 requires organizations to have an external audit performed to assess and report on the effectiveness of internal controls.
• Purpose / Objective The organization is invested in adopting SOX in order to apply a best practice model and be compliance-ready when the company goes public.
• Scope This project will evaluate the design and effectiveness of the preventative and detective controls in the organization to mitigate the process-level risks related to SOX 404 compliance. We will include all key business processes within the project scope, specifically:
  • Entity Level Controls: Control Environment, Risk Assessment, Information and Communication, Monitoring Activities, Control Activities
  • Financial Close & Reporting
  • Disclosure Controls & Procedures
  • Taxation
  • Revenue & Receivables
  • Information Technology General Controls
  • Spreadsheet Controls
  • Procurement
  • Treasury
  • Inventory
  • Payroll & Human Resources
  • Property Plant & Equipment

Scenario

One of your responsibilities as a SOX Audit Manager is to document narratives that describe each process. You need to construct a narrative that relates to the Revenue & Receivables process in the Canada - SOX Review 2018 project. In the narrative, you plan to define the process, clearly outline the IT systems that support the billing processes, and attach a summary of the risks and primary controls associated with the process. As you gather more information, you intend to update the narrative, accordingly.

Process

Help topic Defining narratives

You navigate to the Narratives tab in the project, and add a new narrative entitled Revenue Recognition Process Narrative.

You begin defining the narrative as follows:

Process Overview Revenue recognition is the process of recording revenue, invoices, and accounts receivable for North America (NA).

IT Systems

Finally, you attach a Word document containing a summary of risks and primary controls associated with the Revenue & Receivables process.

Result

The first portion of the narrative is drafted, and the Word document is added as a supporting attachment. In many cases, narratives need to be updated on a quarterly, or interim and roll-forward basis.

To add workflow management and automation around the broadcasting and review of updated flowcharts, narratives, and other process-related documentation, you can:

• sign-off on your work, and assign a member on your team as the next reviewer of the narrative content
• create a hyperlink in your respective SOX 404 project to the aggregate flowchart reports

Scenario

Your organization has a mature and refined risk assessment process, and evaluates risk across two dimensions (Impact and Likelihood). Impact is scored on a 5-point scale and Likelihood is scored on a 3-point scale.

You need to evaluate the inherent risk score to determine the raw risk the organization faces if no controls or other mitigating factors have been put in place. You also want to assign your primary controls an effectiveness score, so that during testing later on, any failed control will provide a residual risk score.

Process

Help topics

• Defining risks and controls
• Tracking assurance using frameworks

You capture the following information in the Canada - SOX Review 2018 and Brazil - SOX Review 2018 projects:

You also assign an effectiveness score (Control Weight) to the associated controls in each project:

• REV-03 30%
• REV-04 20%
• REV-05 50%

Result

The inherent risk assessment is completed. Inherent and residual risk scores are aggregated to the framework for reporting purposes. The residual risk score remains the same as the inherent risk score until control design and effectiveness is evaluated.

Scenario

You need to gather additional information from the Accounting department to better understand the organization's cash inflow as it pertains to sales of merchandise.

Process

Help topic Adding requests

You send a request to the Accounting department, asking for a summary of the cash receipts journal for the current accounting period.

• Description Please provide a summary of the cash receipts journal for the current accounting period.
• Status Open
• Owner Accounting
• Due Date 08/03/2018

Result

Accounting receives the request and is able to provide the relevant documentation by attaching a file and posting a comment.

Scenario

Now that you have assessed inherent risk and obtained the requested documentation, you need to perform a walkthrough to evaluate the design of each control.

Process

Help topic Executing procedures and testing controls

You capture the following walkthroughs in both the Canada - SOX Review 2018 and Brazil - SOX Review 2018 projects:

Designed appropriately

Project	Risk	Control	Control Attributes	Walkthrough Results
Canada - SOX Review 2018	REV-R.01: Untitled Risk	REV-03	Description Cash receipts are reconciled to the bank statement and underlying invoices by the Accountant to ensure accurate, complete and consistent recording in the appropriate accounting period. The Controller reviews the reconciliation and approves the related journal entries. Weight 30%
		REV-04	Description Shipments occurring shortly before or after the end of an accounting period are reviewed by the Controller to ensure complete and consistent recording in the appropriate accounting period, including review of the related invoices. Weight 20%
		REV-05	Description The Controller performs a reconciliation of revenue for the period and compares it to the revenue activity reported by department. Any large variances are reviewed and investigated as required. Weight 50%
Brazil - SOX Review 2018	REV-R.01: Untitled Risk	REV-03	Description Cash receipts are reconciled to the bank statement and underlying invoices by the Accountant to ensure accurate, complete and consistent recording in the appropriate accounting period. The Controller reviews the reconciliation and approves the related journal entries. Weight 30%
		REV-04	Description Shipments occurring shortly before or after the end of an accounting period are reviewed by the Controller to ensure complete and consistent recording in the appropriate accounting period, including review of the related invoices. Weight 20%
		REV-05	Description The Controller performs a reconciliation of revenue for the period and compares it to the revenue activity reported by department. Any large variances are reviewed and investigated as required. Weight 50%

Result

The walkthrough for each control is captured in both projects:

Scenario

Before you launch into testing the effectiveness of controls, you need prepare a test plan that identifies how you will test each control. You want to define the testing method, the total sample size (split amongst testing rounds), and test steps that need to be performed to test the control.

Process

Help topic Executing procedures and testing controls

You document the test plan for REV-03 as follows:

• REV-03 Cash receipts are reconciled to the bank statement and underlying invoices by the Accountant to ensure accurate, complete and consistent recording in the appropriate accounting period. The Controller reviews the reconciliation and approves the related journal entries.
• Testing Method Inspection
• Total Sample Size 25
• Test Steps / Test Attributes
  1. Confirm there is an appropriate segregation of duties.
  2. Confirm accounts receivable balances.
  3. Compare details of cash receipts with journal entries and corresponding bank deposit slips.
  4. Trace bank transfers and perform cash cutoff tests to ensure that appropriate transactions are included in financial statements.
  5. Compare cash balances with forecasts and budgets.

Result

The test plan for REV-03 is captured.

Scenario

Now that you have evaluated control design, and prepared a test plan that defines how you will test each control, you need to evaluate control effectiveness to determine the residual risk, or how much risk remains after controls have been put in place.

Process

Help topics

• Executing procedures and testing controls
• Tracking assurance using frameworks

You test the operational effectiveness of each control in both the Canada - SOX Review 2018 and Brazil - SOX Review 2018 projects, and capture the following information:

Operating effectively

Exception(s) noted

Project	Risk	Control	Control Attributes	Q1 Testing	Q2 Testing	Q3 Testing	Q4 Testing
Canada - SOX Review 2018	REV-R.01: Untitled Risk	REV-03	Description Cash receipts are reconciled to the bank statement and underlying invoices by the Accountant to ensure accurate, complete and consistent recording in the appropriate accounting period. The Controller reviews the reconciliation and approves the related journal entries. Weight 30%
		REV-04	Description Shipments occurring shortly before or after the end of an accounting period are reviewed by the Controller to ensure complete and consistent recording in the appropriate accounting period, including review of the related invoices. Weight 20%
		REV-05	Description The Controller performs a reconciliation of revenue for the period and compares it to the revenue activity reported by department. Any large variances are reviewed and investigated as required. Weight 50%
Brazil - SOX Review 2018	REV-R.01: Untitled Risk	REV-03	Description Cash receipts are reconciled to the bank statement and underlying invoices by the Accountant to ensure accurate, complete and consistent recording in the appropriate accounting period. The Controller reviews the reconciliation and approves the related journal entries. Weight 30%
		REV-04	Description Shipments occurring shortly before or after the end of an accounting period are reviewed by the Controller to ensure complete and consistent recording in the appropriate accounting period, including review of the related invoices. Weight 20%
		REV-05	Description The Controller performs a reconciliation of revenue for the period and compares it to the revenue activity reported by department. Any large variances are reviewed and investigated as required. Weight 50%

Result

Testing results associated with the control are aggregated to the framework for reporting purposes:

Scenario

Since Q4 Testing for Control REV-03 failed in the Brazil - SOX Review 2018 project, you need to note the exception by logging a deficiency. You also want to create a specific follow-up measure that is associated with the identified deficiency, and assign it to the appropriate staff member.

Process

Help topics

• Recording issues
• Recording actions

You document the following deficiency and action in the Brazil - SOX Review 2018 project:

Issue

• Title/Headline Inadequate segregation of duties
• Description Segregation, or separation, of accounting duties means dividing the tasks so that different people are handling transaction processing, data recording, financial statement preparation and auditing. Relying on one person to handle all the accounting functions could lead to poor internal controls, accounting fraud and misappropriation of company assets.
• Owner Accounting Manager
• Issue Type Deficiency
• Date Identified Date
• Severity High - Serious audit observation that leads to financial loss
• Published Published

Action

• Title Enforce the segregation of duties and / or implement compensating controls
• Owner Accounting Manager
• Description Ensure that the accounting department is organized in a way that achieves adequate separation of duties. When duties cannot be separated, implement the following compensating controls:
  • Handle all exception reports at the supervisory level
  • Implement role-based access control in IT systems
• Due Date Date
• Status Opened
• Priority High

Result

The deficiency and action are captured. At a later date, Audit can review the remediation plan, and document retesting results to determine whether or not the deficiency has been truly remediated.

Scenario

You need to provide detailed control testing status information to your PMO. The report should include control testing progress for both projects (Canada - SOX Review 2018 and Brazil - SOX Review 2018), including control attributes, effectiveness evaluations, and control test preparer sign-offs. You also want to provide the opportunity to filter control testing data based on project or effectiveness scoring.

Process

Help topics

• Copying reports and dashboards
• Broadcasting reports via email

First, you copy the Control Testing Details report template, and modify the report as needed. Then, you save and activate the report. Finally, you broadcast the report via email to the appropriate recipient on a specified schedule.

Result

The report is shared with the specified recipient on a recurring schedule. Broadcasting a report is an effective way to share data with other people on a recurring basis. If you need to target different audiences, you can set up multiple broadcast schedules for a single report.