The Sarbanes Oxley Act requires management to make an assessment of the design and operational effectiveness of internal controls. In the first place, management has to design controls to ensure that financial reporting risks are reduced to an acceptable level. Once this is done, the designed internal controls have to be validated and tested over a period of time to check whether the same are operating as desired.
How does one check the operating effectiveness of controls? Well, there are many ways to do the same.

Some of the most common are-

- Internal Audit Validation
- Monitoring by Process Owners
- Monitoring at the Entity Level
- Monitoring through Operating Management

It is the management's call to decide how, when, and at what frequency controls are to be validated. Quarterly self assessments can be made to get a reasonable level of assurance for the operating effectiveness of controls. I have seen in many organizations where the internal audit function has played a proactive role in assessing operating effectiveness. Internal audit can seperately take responsibility and conduct assessments on a continous basis.

Read Further >>

Benefits of Section 404 , SEC Accounting Standards , Inspection of Public Accounting Firms , COSO Guidance for Small Public Companies