Some of you may recall, sometime back I had discussed about tests of controls which form part of the entire sarbanes oxley integrated audit. One key statements giving guidance in performing tests of controls is

Sufficient appropriate evidence about the effectiveness of internal control depends upon the nature, timing and extent of our test of controls.

I would discuss each aspect i.e. the nature, timing and extent of controls testing in days to come. As an auditor, it is very important to understand that assurance as to the effectiveness of design and operating effectiveness of each of the financial statement assertions controls is needed. Within the business control framework, one may find that some control activites have a very low rate of change or change very infrequently. Normally, automated controls fall in this category which do not vhange unless the process undergoes a change. To gain comfort on the effectiveness of design and operating effectiveness of controls an auditor may vary the nature timing and extent of procedures applied as tests of controls.

An auditor may thus choose combination of procedures such as inquiry, observation, reperformance to test controls. Another such variation can be in the dates selected to perform the test of controls. Similarly, if an organization operates from various locations, an auditor can can also vary the locations selected to test controls.

Related Posts

Five Simple Steps for Better SOX Compliance
Implementing Enterprise Risk Management Framework
SOX Record Retention Requirements
Evaluating IT Controls as part of ICOFR