Section 404 requires management to test key controls which form part of the system of internal controls over financial reporting. So how does one define what is a key control? Although the PCAOB has used the term key controls in many of its documents and standards, there is no commonly accepted definition of key control. Recently, the IIA in a whitepaper on SOX has given a geenrally accepted definition of key control. Accordingly, a key control is defined as -

"A key control is a control that, if it fails, means there is at least a reasonable likelihood that a material error in the financial statements would not be prevented or detected on a timely basis."

Jeff and Louise, two SME's sarbanes oxley subject matter experts in our firm analyzed the above definition and came up with a much simpler version of the above definition of key controls. They define key controls simply as -

"A key control is a control that provides reasonable assurance that material errors will be prevented or detected in a timely manner."

Whichever definition your comfortable with, identifying key controls is neccesary for successful 404 compliance project. While identifying key controls, it is important not to define too many controls as key controls. This dilutes the importance of the controls assessment exercise and results in excess time as well as resources. Jeff explains the flip side that if too few controls are identified, management may have to incorporate additional key controls based on internal controls assessment of the auditor. I would also cover different approaches to identify key controls later in my posts.

Related Posts

Audit Partner Rotation - Section 203
Sarbanes Oxley & XBRL
Evaluating ITGC for SOX
Sarbanes Oxley Record Retention Requirements