IT controls are an important part of any organizations control environment. An organization needs to evalute the risks surrounding its IT environment and come up with controls to mitigate such risks. IT risks and controls evaluation have become all the more important in light of the requirements of Section 404 of the Sarbanes Oxley act. An organization should evaluate its information technolgy risks and controls during its Section 404 evaluation project.

Let me explain. An enterprise needs to evaluate IT risks at an early stage. This is important because when the 404 project compliance team decides the overall plan for evaluation of internal controls over business processes, the Sarbanes Oxley Section 404 compliance team needs to understand how IT controls will impact the overall control environment. Information technology controls include IT entity level controls and general IT controls at the process level. After a preliminary evaluation of the entity and general IT controls, the 404 compliance project team should decide which controls to document and evaluate so that management can arrive at a conclusion on internal controls over financial reporting. If technology controls are weak, management would need to lay extra emphasis on documentation and evaluation. On the other hand, if the IT controls are strong, the amount of effort involved would definetly be less.

Related Posts

Sarbanes Oxley and XBRL
Sarbanes Oxley Automation Softwares
Internal Control Maturity Framework
Sarbanes Oxley Cost Reduction