SOX (part of
United States federal law) requires the chief executive and chief financial officers of public companies to attest to the accuracy of financial reports (Section 302) and require public companies to establish adequate internal controls over financial reporting (Section 404). Passage of SOX resulted in an increased focus on IT controls, as these support financial processing and therefore fall into the scope of management's assessment of internal control under Section 404 of SOX. The COBIT framework may be used to assist with SOX compliance, although COBIT is considerably wider in scope. The 2007 SOX guidance from the PCAOB and SEC state that IT controls should only be part of the SOX 404 assessment to the extent that specific
financial risks are addressed, which significantly reduces the scope of IT controls required in the assessment. This scoping decision is part of the entity's
SOX 404 top-down risk assessment. In addition, Statements on Auditing Standards No. 109 (SAS109) discusses the IT risks and control objectives pertinent to a financial audit and is referenced by the SOX guidance. IT controls that typically fall under the scope of a SOX 404 assessment may include: • Specific application (
transaction processing) control procedures that directly mitigate identified financial reporting risks. There are typically a few such controls within major applications in each financial process, such as accounts payable, payroll,
general ledger, etc. The focus is on "key" controls (those that specifically address risks), not on the entire application. • IT general controls that support the assertions that programs function as intended and that key financial reports are reliable, primarily
change control and
security controls; • IT operations controls, which ensure that problems with the processing are identified and corrected. Specific activities that may occur to support the assessment of the key controls above include: • Understanding the organization’s
internal control program and its
financial reporting processes. • Identifying the IT systems involved in the initiation, authorization, processing, summarization and reporting of financial data; • Identifying the key controls that address specific financial risks; • Designing and implementing controls designed to mitigate the identified risks and monitoring them for continued effectiveness; • Documenting and testing IT controls; • Ensuring that IT controls are updated and changed, as necessary, to correspond with changes in internal control or financial reporting processes; and • Monitoring IT controls for effective operation over time. To comply with Sarbanes-Oxley, organizations must understand how the financial reporting process works and must be able to identify the areas where technology plays a critical part. In considering which controls to include in the program, organizations should recognize that IT controls can have a direct or indirect impact on the financial reporting process. For instance, IT application controls that ensure the completeness of transactions can be directly related to financial assertions. Access controls, on the other hand, exist within these applications or within their supporting systems, such as
databases,
networks, and
operating systems, which are equally important, but do not directly align to a financial assertion. Application controls are generally aligned with a
business process that gives rise to financial reports. While there are many IT systems operating within an organization, Sarbanes-Oxley compliance only focuses on those that are associated with a significant account or related business process and mitigate specific material financial risks. This focus on risk enables management to significantly reduce the scope of IT general control testing in 2007 relative to prior years.
Real-time disclosure Section 409 requires public companies to disclose information about material changes in their financial condition or operations on a rapid basis. Companies need to determine whether their existing financial systems, such as enterprise resource management applications are capable of providing data in real-time, or if the organization will need to add such capabilities or use special software to access the data. Companies must also account for changes that occur externally, such as changes by customers or business partners that could materially impact their own financial positioning (e.g. key customer/supplier bankruptcy and default). To comply with Section 409, organizations should assess their technological capabilities in the following categories: :*
Availability of internal and external portals - Portals help route and identify reporting issues and requirements to investors and other relevant parties. These capabilities address the need for rapid disclosure. :*
Breadth and adequacy of financial triggers and alert - The organization sets the trip wires that will kick off a Section 409 disclosure event. :*
Adequacy of document repositories – Repositories play a critical role for event monitoring to assess disclosure needs and provide mechanism to audit disclosure adequacy. :*
Capacity to be an early adopter of Extensible Business Reporting Language (XBRL) – XBRL will be a key tool to integrate and interface transactional systems, reporting and analytical tools, portals and repositories. ==See also==