Sarbanes Oxley requires management to identify significant accounts, based on materiality and then identify relevant financial statement assertions, transactions and events underlying these financial statement accounts. This is infact the starting point of the SOX 404 project. But how does one go about linking financial statement accounts, assertions and the relevant risks. Though its difficult to suggest one single solution, a broad guidance is given below.

1. In step one, management needs to identify is significant accounts. Management can use previous years financial statements as the starting point. However, significant accounts need to be determined based on what management thinks as material to financial reporting.

2. Once accounts are identified, these need to be linked to financial statement assertions. I have already done a detailed post on financial statement assertions here.

3. Once the financial assertions are determined, management, needs to look at the business processes and business units supporting the financial statement accounts. This can be done using a deep understanding of the relevant business processes and process maps.

4. Lastly, the business processes need to be linked to risks. This is possible through a risk assessment. More specifically, account risk analysis needs to be mapped to business processes.

Related Posts

Pervasive ITGC for SOX
Sponsorship for Internal Audit Function
Adverse Report on Internal Controls
Significant Spreadsheets for Sarbanes Oxley