Sarbanes Oxley requires quite a bit of documentation of entity's
controls. Every little detail right from the business process to the controls within the process, the associated risks etc need to be well documented to enable the external auditor to reach a conclusion on internal control over financial reporting. This brings us to the question that, if documentation is so important, why not have documentation standards and documentation templates which support the SOX compliance process.

Most companies I have worked with have some documentation standards and
templates which are used in the controls compliance. Specifically,
documentation standards should lay down the level of detail and accuracy
required in the SOX documentation phase. The biggest benefit of having
documentation standards is that it helps in identification of key
controls. Documentation standards should normally address documentation of controls using one of the following:

1. Business Process Cycle Narratives
2. Business Process Cycle Flowcharts
3. Business Process Cycle Control Matrices
4. Interviewing Business Process Owners

The above four points form the crux of the documentation process and a
documentation standard which addresses these four criteria eases the
SOX compliance in the long run. As far as templates for SOX
documentation are concerned, companies can use a customized or a ready-to-go template. But, the template should be complete in terms of documenting all relevant and required controls information.

Related Posts

Reporting Material Weakness to Management
Application Level Controls for SOX
Training Workshops for Sarbanes Oxley
Analyzing the COSO Cube - Internal Control Dimensions