audit-support-overview

name	audit-support-overview
description	Sub-skill of audit-support: Overview (+3).
version	1.0.0
category	business
type	reference
scripts_exempt	true

Overview (+3)

Overview

SOX Section 404 requires management to assess the effectiveness of internal controls over financial reporting (ICFR). This involves:

1. Scoping: Identify significant accounts and relevant assertions
2. Risk assessment: Evaluate the risk of material misstatement for each significant account
3. Control identification: Document the controls that address each risk
4. Testing: Test the design and operating effectiveness of key controls
5. Evaluation: Assess whether any deficiencies exist and their severity
6. Reporting: Document the assessment and any material weaknesses

Scoping Significant Accounts

An account is significant if there is more than a remote likelihood that it could contain a misstatement that is material (individually or in aggregate).

Quantitative factors:

• Account balance exceeds materiality threshold (typically 3-5% of a key benchmark)
• Transaction volume is high, increasing the risk of error
• Account is subject to significant estimates or judgment

Qualitative factors:

• Account involves complex accounting (revenue recognition, derivatives, pensions)
• Account is susceptible to fraud (cash, revenue, related-party transactions)
• Account has had prior misstatements or audit adjustments
• Account involves significant management judgment or estimates
• New account or significantly changed process

Relevant Assertions by Account Type

Account Type	Key Assertions
Revenue	Occurrence, Completeness, Accuracy, Cut-off
Accounts Receivable	Existence, Valuation (allowance), Rights
Inventory	Existence, Valuation, Completeness
Fixed Assets	Existence, Valuation, Completeness, Rights
Accounts Payable	Completeness, Accuracy, Existence
Accrued Liabilities	Completeness, Valuation, Accuracy
Equity	Completeness, Accuracy, Presentation
Financial Close/Reporting	Presentation, Accuracy, Completeness

Design Effectiveness vs Operating Effectiveness

Design effectiveness: Is the control properly designed to prevent or detect a material misstatement in the relevant assertion?

• Evaluated through walkthroughs (trace a transaction end-to-end through the process)
• Confirm the control is placed at the right point in the process
• Confirm the control addresses the identified risk
• Performed at least annually, or when processes change

Operating effectiveness: Did the control actually operate as designed throughout the testing period?

• Evaluated through testing (inspection, observation, re-performance, inquiry)
• Requires sufficient sample sizes to support a conclusion
• Must cover the full period of reliance