| name | audit-support-overview |
| description | Sub-skill of audit-support: Overview (+3). |
| version | 1.0.0 |
| category | business |
| type | reference |
| scripts_exempt | true |
Overview (+3)
Overview
SOX Section 404 requires management to assess the effectiveness of internal controls over financial reporting (ICFR). This involves:
- Scoping: Identify significant accounts and relevant assertions
- Risk assessment: Evaluate the risk of material misstatement for each significant account
- Control identification: Document the controls that address each risk
- Testing: Test the design and operating effectiveness of key controls
- Evaluation: Assess whether any deficiencies exist and their severity
- Reporting: Document the assessment and any material weaknesses
Scoping Significant Accounts
An account is significant if there is more than a remote likelihood that it could contain a misstatement that is material (individually or in aggregate).
Quantitative factors:
- Account balance exceeds materiality threshold (typically 3-5% of a key benchmark)
- Transaction volume is high, increasing the risk of error
- Account is subject to significant estimates or judgment
Qualitative factors:
- Account involves complex accounting (revenue recognition, derivatives, pensions)
- Account is susceptible to fraud (cash, revenue, related-party transactions)
- Account has had prior misstatements or audit adjustments
- Account involves significant management judgment or estimates
- New account or significantly changed process
Relevant Assertions by Account Type
| Account Type | Key Assertions |
|---|
| Revenue | Occurrence, Completeness, Accuracy, Cut-off |
| Accounts Receivable | Existence, Valuation (allowance), Rights |
| Inventory | Existence, Valuation, Completeness |
| Fixed Assets | Existence, Valuation, Completeness, Rights |
| Accounts Payable | Completeness, Accuracy, Existence |
| Accrued Liabilities | Completeness, Valuation, Accuracy |
| Equity | Completeness, Accuracy, Presentation |
| Financial Close/Reporting | Presentation, Accuracy, Completeness |
Design Effectiveness vs Operating Effectiveness
Design effectiveness: Is the control properly designed to prevent or detect a material misstatement in the relevant assertion?
- Evaluated through walkthroughs (trace a transaction end-to-end through the process)
- Confirm the control is placed at the right point in the process
- Confirm the control addresses the identified risk
- Performed at least annually, or when processes change
Operating effectiveness: Did the control actually operate as designed throughout the testing period?
- Evaluated through testing (inspection, observation, re-performance, inquiry)
- Requires sufficient sample sizes to support a conclusion
- Must cover the full period of reliance
