In the Sarbanes Oxley compliance journey, many companies face the onslot of significant deficiencies. Identifying a significant deficiency is one thing, tacking it is another. My experience shows that even though companies are able to identify significant deficiencies, but when the time comes to remediate them, companies are in a fix. Recently, we helped one of our clients in the automotive industry in setting up an action plan for remediating significant deficiencies. Here are some jottings from the plan for your guys!

Prioritizing the deficiencies - After identifying deficiencies it is important to prioritize them. This can be done based on significance, financial statement impact, magnitude, likelihood. Our client used an decision matrix incorporating the factors above.

Deficiency Responsiblity for Process Owners - Process owners should take resposnibility and present significant deficiencies to senior management and audit committee. Process owners should also accompany a plan for as to how the deficiency will be remediated.

Tranings to Identify Deficiencies - One thing we suggested to the client was to institute a training program which will help the ground level users, process owners to identify, manage and dispose of deficiencies. This should involve not only functional guys, but also IT, finance and other cross functional concerned departments.

Timely Escalation & Disposition - Every deficiency identified should be timely escalated to senior management and a file should be maintained documenting how the company proposes to dispose / remediate the deficiency.

Related Posts

Spreadsheets & SOX Compliance
Direct Evidence for judging effectiveness of ICOFR
COSO - Factors affecting Control Environment
SOX Documentation - How much is Enough?