Sarbanes Oxley Act requires the companies management to make a periodic assessment of internal controls. Management can perform this assessment by periodically testing the internal controls. Most of the clients I have helped in implementing Section 404 have developed a testing strategy for testing internal controls. Some of the factors management should consider before developing a testing strategy are listed below. I have listed the same in the form of questions.

1. What is the complexity of control?
2. Whether control is automated or manual?
3. Whether there are any changes in the design of control?
4. Are there any changes in personnel performing or monitoring the control?
5. What is Nature and significance of control in meeting the control objective?
6. What effect does significant changes in volume and nature of business have on design or operating effectiveness of control?
7. Degree of reliance on IT or general computer controls for effectiveness?

Technology Tools for Sarbanes Oxley
Accountability Risk Factors
Section 404 Project Scoping