Sometime back in Januray this year, I had written about how the Project Management Maturity model could be applied to a Sarbanes Oxley 404 implementation. Once the risk and control matrices (commonly known as
RCM's) are ready, companies can go in for testing the controls. Usually, sarbanes oxley controls testing is a time bound plan where resources i.e. testers are identified, testing locations are notified, and a time plan is made. I have seen many SOX directors in companies taking up SOX testing as a project. Usually they apply the same skills they would apply to any important project. SOX Directors need to ensure that the following
areas are taken into account in the testing project.

Scope Management - Testing should ensure that all key controls are tested. Similarly significant accounts which have a direct bearing on financial statements should also be covered. Generally, scope management is to ensure that all significant items have been covered under testing.

Time Management - Time management ensures timely completion of SOX testing. Testing time / schedule allocated for inquiry & observation and for examination & reperformance needs to be strictly adhered to in order to ensure time bound completion.

Cost Management - Cost management takes care of actual project costs against budgets. Costs involved in actual controls testing need to be estimated, budgeted and planned. Comparing Actual Vs. Budgeted costs
of testing is also a part of cost management.

Quality Management - For sarbanes oxley controls testing to achieve its purpose, it should pass the neccesary quality assurance tests. Quality standards for SOX testing are normally laid down by SOX directors / steering committee.

Integration Management - Finally, for successfully managing a SOX testing project, it should be ensured that all the various elements of the project are properly coordinated. This is normally the responsibility of SOX project manager. Project change control, project plan execution and development normally come under integration management.

Related Posts

For the Love of Sarbanes Oxley
Sampe Size Selection for Evaluating Operational Effectiveness
How to Make a Project Plan for SOX Compliance
Indirect Company Level Controls