Section 404 of SOX requires management to assess the effectiveness of internal controls over financial reporting. Such evaluation needs to be done of the design of controls as well as the operating effectiveness of controls. Management can use various testing strategies for evaluating the effectiveness of internal controls. However, one important criteria is that of the "Nature of Tests" to be perfomed. The nature of tests performed provide various degrees of comfort to the management or auditor. There are four types of tests namely, Inquiry, Observation, Examination and Reperformance which provide increasing level of comfort and assurance respectively to the auditor. Let me discuss each one seperately.

Inquiry - Inquiry refers to asking control questions. It aims at getting relvant information from the staff through questions and answer based techniques. However, inquiry alone is not sufficient to get comfort on operating effectiveness of controls.

Observation - Observation refers to observing a control procedure being performed. The actual operation of the control is seen. This type of test gives a much higher level of assurance than inquiry.

Examination - Examination refers to evaluation of procedures and practices with the help of available data such as reports. Examination relies on facts and is a powerful way of gathering evidence as well as testing. It is normally used most since gives more comfort than above two tests.

Repeformance - Finally, in case the control on which auditor wants to rely on are critical to the completion of the audit, reperformance is used. In Reperformance, the data and facts are verified by actually reperforming a sample of the work. Reperformance provides the highest level of comfort to the auditor.

Related Posts.......................

7 Steps for Better SOX Compliance , Project Management for Sarbanes Oxley , Implementing ERM Enterprise Risk Management Framework