Auditing standard 2 of the PCAOB has some excellent guidance which can help auditors in determining the locations that they should be testing for effectiveness of internal controls over financial reporting. The guidance which PCAOB has given is more in the fom of a flowchart. Following the flowchart is simple and easy. The flowchart can be seen in AS2. Using the flowchart is both simple and easy. Each box in flowchart asks questions, which if correctly answered can lead the auditor in decidingwhether to test a location or not.

1. The first questions asks whether a location or business unit is
individually important or not. If it is, then documentation needs to be
evaluated and controls over relevant assertions for significant accounts need to be tested at each such business unit and location.

2. If the answer to the above question is no, then the next question is are there specific significant risks related to that location. If the answer is yes, then such specific risks need to be documented and tested.

3. If the answer to Question 2 above is a no, Is the location important when aggregated with other locations. If yes, then atleast company level controls for this aggregated group should be present. This indicates that company level controls need to be documented and tested.

4. If answer to 3 above is no, then no further action is required.

Related Posts

Sarbanes Oxley 302 Certification
Internal Audit Charter and SOX
Role of Process Owners in SOX Compliance
Sarbanes Oxley Controls Documentation