Most companies covering required to comply with Sarbanes Oxley go through many rounds of testing. These are commonly called as round 1 testing, round 2 testing, remediation testing and so on. Any control deficiencies which are noted at the time of such testing need to be remediated before the year end. In one of my earlier posts, I had discussed the concept of control deficiency in terms of Sarbanes Oxley. Management should look at both qualitative and quantitiative considerations before deciding on the remediation steps to be taken. Today, I am discussing some of the qualitative aspects of control deficiencies as illustrated in the PCAOB guidance on financial statement audit.

1. Nature of the control deficiency
2. Cause of the control deficiency
3. Relevant financial statement assertion the control was designed to support
4. Effect of the deficiency on the control environment
5. Existence of compensatiing controls which cater to the control deficiency.

For each control deficiency identified, management should ask the above five questions. This will help the management in concluding what remediation steps need to be taken. Or whether compensating controls do not warrant any remediation steps.

More on Sarbanes Oxley

Sample Size Selection For Evaluating Controls
Control Self Assessment for Sarbanes Oxley
Sarbanes Oxley Audit Fees
Internal Control Matrix