Section 404 of the Sarbanes Oxley emphasizes not only on financial reports issued by a company, but also on the underlying processes and controls that are integral to the overall environment of an organization. Keeping this in view, the PCAOB recognized that an audit of internal controls over financial statements and audit of financial statements had to be integrated as one.

If we look from the point of view of the auditors, how does he evaluate the effectiveness of internal controls over financial reporting. All auditors base their audit on evidences. Thus, an auditor must obtain direct evidence relating to effectiveness of internal control over financial reporting. A auditor simply cannot rely on the process controls for making an opinion on controls effectiveness. An auditor must corroborate his opinion with testing of the controls placed in operation. Without enough direct evidence, an auditor would not have a high level of assurance that management's assessment of internal controls is correct. In addition, the external auditor for Sarbanes Oxley must also evaluate management's documentation of design of internal controls. Direct Evidence helps the external auditor in doing so.

More on Sarbanes Oxley ...............

>> Sarbanes Oxley IT Best Practices
SOX & PCAOB Auditing Standard 2
>> Identifying Material Weaknesses in Controls
>> Sarbanes Oxley Accountability Risk Factors