Sarbanes-Oxley Section 404:

Management’s Assessment Process

Frequently Asked Questions

A DV I S O RY
Contents

1 Introduction

2 Providing a Road Map for Management

3 Questions and Answers

3 Section I. Planning and Determining the Scope of the

Assessment

8 Section II. Documenting and Evaluating the Design and

Operating Effectiveness of Controls

13 Section III. Identifying, Assessing, and Correcting Deficiencies

15 Section IV. Reporting on Internal Controls

16 Conclusion
Introduction

KPMG LLP has prepared this document for management, members of corporate
teams working toward Sarbanes-Oxley Act of 2002 (the Act) section 404 (S-O
404) compliance, and audit committee members. It is designed to help clarify a
number of key issues related to management’s assessment process as required
by S-O 404. Specifically, it addresses frequently asked questions and provides
general guidelines that management may use for planning and assessing the
effectiveness of internal control over financial reporting.

It is important that readers understand that management is responsible for

complying with the provisions of the Sarbanes-Oxley Act, and specifically with
section 404. Management should consult with legal counsel, independent
auditors, and other professionals in meeting these obligations.

This document contains only a general discussion of the matters included and
should not be relied on as advice for any particular company, since no
consideration is given to individual facts and circumstances, which could vary
greatly from company to company. Some of the discussions in this document are
based on the questions and answers issued by the staffs of the Securities and
Exchange Commission’s (SEC’s) Chief Accountant and Division of Corporation
Finance and by the staff of the Public Company Accounting Oversight Board
(PCAOB). The views and opinions of the staffs of the SEC and PCAOB could
change in the future.

It is important to note that an example of the evolving nature of this discussion

occurred as this document was being finalized for printing. This includes the
issuing of a revised set of questions and answers from the SEC staff as well as
additional questions and answers from the PCAOB staff. These recently released
questions and answers provide further clarification on issues relating to the
following matters, among others:
• The scope of internal control over financial reporting as it relates to compliance
with laws and regulations
• The effect that the lack of an available Type II report under the AICPA
Statement on Auditing Standards (SAS) 70 from a service organization can have
on management’s assessment and the independent auditor’s reports
• The independent auditor’s walkthrough of major classes of transactions
processed by a service organization

Ongoing revisions such as these add even more urgency to our recommendation
that management should work closely with counsel, the company’s independent
auditors, and other advisers to determine the potential impact these or any future
guidance revisions may have in light of the organization’s specific circumstances.
Providing a Road Map for Management

In this document, which is part of our • Supporting its evaluation with sufficient
ongoing commitment to helping companies evidence, including documentation
remain current with these issues, we • Presenting a written assessment of the
address a number of questions, many of effectiveness of the company’s ICOFR
which management already may have as of the end of the most recent fiscal
encountered. year

We also discuss general guidelines that Management fulfills these responsibilities

management may use as a starting point to by undertaking a comprehensive approach
answer questions that arise as it develops that includes thorough planning and
and implements its own assessment evaluation of its system of internal
processes. controls. Management should document
the company’s controls and begin testing
Understanding the Roles: their effectiveness. It is important that
Management and the Independent
management allow sufficient time to
Auditor
complete this process in order to provide
Management is responsible for including
an appropriate basis for its assessment and
an internal control report in its annual
to respond to any deficiencies that are
report that:
identified. Identifying deficiencies early
• States the responsibility of management
may provide management with sufficient
for establishing and maintaining an
time to correct deficiencies and determine
adequate internal control structure and
the operating effectiveness of the controls
The Sarbanes-Oxley Act has changed the procedures for financial reporting
prior to year-end reporting.
face of corporate governance. Many • Contains an assessment, as of the end of
organizations are already at work planning the most recent fiscal year of the issuer,
There are a number of methods a company
and implementing processes that will help of the effectiveness of the internal
may choose in developing an approach to
them assess the effectiveness of their control structure and procedures of the
fulfilling its responsibilities related to its
internal control over financial reporting issuer for financial reporting.
assessment of internal control over
(ICOFR).
financial reporting. Regardless of the
A key aspect of this process has been The independent auditor is responsible for
method chosen, it is management’s
trying to anticipate and address the attesting to and reporting on the
responsibility to design and implement a
questions and issues that might arise as assessment made by the management of
process that enables it to meet the
management prepares for an audit of the issuer.
requirements of section 404 of the Act.
ICOFR.
For the independent auditor to
Recently, the SEC and the PCAOB satisfactorily complete an audit of internal
provided additional guidance to registrants control over financial reporting,
and independent auditors about some of management must fulfill a number of
these issues. Using this guidance along important responsibilities1, including:
with the collective experience already • Accepting responsibility for the
gained by management, we can begin to effectiveness of the company’s ICOFR
identify and address some of the questions • Evaluating the effectiveness of the
and issues facing management. company’s ICOFR using suitable control
criteria, such as the COSO (Committee
of Sponsoring Organizations of the
Treadway Commission) criteria
1
If the auditor concludes that management has not fulfilled these
responsibilities, the auditor should communicate in writing to
management and the audit committee that the audit of internal
control over financial reporting cannot be satisfactorily completed
and the auditor must disclaim an opinion.
2 SARBANES-OXLEY SECTION 404
 Questions and Answers

In the following pages we offer answers to common questions that may arise
during these steps of the assessment process:
• Planning and determining the scope of the assessment
• Documenting and evaluating the design and operating effectiveness of
controls
• Identifying, assessing, and correcting deficiencies
• Reporting on internal controls
These represent only some of the questions that management may ask.
Some may not apply to your organization because of your specific
assessment processes. More importantly, these answers are not absolute.
They are intended to offer management a starting point from which to
develop its own answers to specific assessment questions.
In addition, management should review the authoritative literature issued by
the SEC for registrants and by the PCAOB for independent auditors to gain a
more complete understanding of what is expected of the company. This will
also help management better prepare itself for the respective reporting
deadlines.

Section I. Planning and Should management document No particular form of documentation is

ICOFR for all locations or business required and the form and extent of
Determining the Scope units? documentation can vary depending on the
of the Assessment The answer to this question is yes. company’s size, complexity, and
Companies should have some level of documentation approach. However, simply
documentation of ICOFR for all locations having manuals and policies without any
Regardless of the complexity and or business units, including those not reconciliation to the assessment process
breadth of an organization’s control considered significant either individually may not be enough. Management should
structure, evaluating the or in the aggregate. The extent of this be able to demonstrate how it considers
effectiveness of ICOFR requires documentation may vary across locations the documentation in the assessment
careful planning. This plan can or business units and often is based on the process.
include a process that examines the financial significance of each location or
overall approach to documentation, business unit. How does management determine
identification of controls and which controls to test for operating
assessment procedures, significant Management’s documentation may take effectiveness?
milestones, and anticipated many forms. These could include various A key element of management’s
timelines. The plan also may include kinds of information, such as: assessment process is the determination of
instituting policies and procedures • Company policy manuals controls to be tested. Management should
that will be used in the assessment • Process models document the process used to assess the
process and appropriate internal • Accounting manuals effectiveness of ICOFR, including the
communication processes. Following • Memoranda determination of controls to be tested.
are some specific issues that may • Flow charts This documentation will make it easier for
have to be addressed. • Job descriptions the independent auditor to understand
• Documents management’s process and to plan and
• Forms perform the related audit procedures.
• Decision tables
• Procedural write-ups From an independent auditor’s perspective,
• Self-assessment reports an account balance is considered
• Other documentation as appropriate significant if there is more than a remote

MANAGEMENT’S ASSESSMENT PROCESS 3

likelihood that the account could contain Footnote 67 of the SEC’s final rules on that the new risk framework not undermine
misstatements that could have a material Management’s Reports on Internal Control COSO’s earlier work.”2
effect on the financial statements, which, Over Financial Reporting and Certification
in turn, could result in a risk of of Disclosure in Exchange Act Periodic What information technology (IT)
overstatement or understatement. This is Reports states that “the Guidance on systems or applications generally
are included in the scope of S-O 404
true whether the account is viewed Assessing Control published by the
documentation and testing related
individually or in aggregate with others. Canadian Institute of Chartered Accountants to ICOFR?
Other accounts may be considered and the Turnbull Report published by the Applications and the related supporting
significant based on the expectations of a Institute of Chartered Accountants in infrastructure that support key processes,
reasonable user. The assessment as to England & Wales are examples of other control objectives, and relevant assertions
likelihood is made without giving suitable frameworks.” related to significant accounts and
consideration to the effectiveness of disclosures in the financial statements
internal control over financial reporting. Other suitable frameworks available for should be included in the scope of
management’s assessment on internal management’s assessment process.
Components of a financial statement control over financial reporting may be
caption can be subject to differing risks developed in the future. As a result, Because IT applications often support the
(inherent and control) as well as different management may want to review these initiation, authorization, recording,
controls. These components should be frameworks as they emerge to determine processing, and reporting of financial
considered separately as potentially whether they represent more appropriate transactions, IT controls may represent an
significant accounts. Independent auditors methods on which to base assessments. integral part of ICOFR. Financial reporting
may consider separate components of a applications are often supported by many
caption significant due to the company’s What is the Enterprise Risk Manage-
ancillary, or feeder, applications that provide
organizational structure. For example, the ment Framework? Does this replace
the existing COSO framework? critical financial data, and companies may
“accounts receivable net” caption may be rely on a large number of applications to
COSO has released a draft of a document
split into at least three separate accounts: meet their objectives.
entitled, “Enterprise Risk Management
domestic receivables, foreign receivables,
Framework.” The new study incorporates—
and the allowance for doubtful accounts. In Once an application is determined to be in
but does not replace—the 1992 COSO
addition, if a company has a number of the scope of the process, management
study on internal control. Also, it is
separate business units, each with unique should (1) document applicable components
“designed to raise a consistent ‘risk and
management and accounting processes, the of the application, (2) identify significant
control consciousness’ throughout the
components of the captions at each controls designed within the application to
enterprise and to become a commonly
separate business unit or even within a achieve specific objectives, (3) gain an
accepted model for discussing and
business unit also may be individually understanding of the IT architecture and
evaluating the organization’s risk
considered as potentially significant infrastructure around the application, and
management processes.”
accounts. (4) test the four components of IT general
Doug Prawitt of Brigham Young controls (see the chart on page 5) that have
Can a framework other than COSO
University, a member of the COSO a pervasive effect on the application. As
be used?
Advisory Council, was quoted as saying, part of its documentation, management
Management may use a framework other
“Many organizations have adopted the should include a sufficient level of detail to
than COSO, if the framework selected is a
COSO control framework, various audit describe the in-scope processes and
suitable, recognized control framework.
standards rely on that framework, and it significant controls built within the
This can be defined as a framework that
looks like the internal control reporting applications supporting those processes.
has been established by a body or group
required under Sarbanes-Oxley will be The chart on page 5 provides an example of
following due-process procedures, including
heavily based on the COSO internal how IT general controls can be linked to
broad distribution of the framework for
control model. So it was absolutely critical applications and processes.
public comment.

“Bringing ERM into Focus,” Christy Chapman, Internal Auditor, June

2

4 SARBANES-OXLEY SECTION 404 2003

 LINKING IT GENERAL CONTROLS TO APPLICATIONS AND PROCESSES • SAS 70 Type II reports include the items
listed in Type I above and provide a
description of the tests of controls and
results of those tests performed by the
service auditor. They also provide the
Processes service auditor’s opinion on whether the
E.g., Purchasing controls that were tested were operating
effectively during the specified period.
Under certain circumstances,
Applications
E.g., Purchasing System management may be able to obtain
evidence about the operating
effectiveness of controls at the service
Infrastructure organization by obtaining and reviewing
this type of report.

Management should note that there is no

Program Program Computer Access to
Development Change Operations Program/Data assurance that the control objectives
specified within the SAS 70 reporting
cover everything that would be relevant to
IT GENERAL CONTROLS the company’s internal control over
E.g., IT General Controls over the development and maintenance of the Purchasing System
financial reporting. As a result,
management should review the reports to
determine whether any additional
To determine which IT general controls are included in the scope of management’s assessment,
procedures should be performed to support
first identify and document controls at the process level (e.g., purchasing) including the controls
its assessment of all significant control
that are supported by information technology (e.g., purchasing system) where financial
objectives affecting the company.
transactions are processed. The scope of IT general controls can then focus on those controls
In addition, management is responsible for
over the development and maintenance of the application.
maintaining and evaluating controls over
Many organizations outsource certain organization. The service auditor’s report the appropriate flow of information to and
processes, activities, or functions, will be either a Type I or a Type II report from the service organization. This
such as payroll, that are included in under the AICPA Statement includes user controls.
the scope of the S-O 404 assessment.
on Auditing Standards (SAS) 70:
How do controls performed at off-site
locations affect ICOFR? What’s more, • SAS 70 Type I reports indicate whether Other approaches management may
how does management determine the controls described were (1) presented consider for obtaining evidence of ICOFR
and document the operating fairly in all material respects and (2) operating effectiveness related to the
effectiveness of controls at these suitably designed to provide reasonable service organization include performing:
service organizations?
assurance that the control objectives • Tests of the company’s controls over the
If management has determined that a
specified in the description would be activities of the service organization
service organization’s activities are part of
achieved if complied with satisfactorily. (re-performance)
the company’s information system,
A Type I report provides no assurance • Tests of controls at the service
management should evaluate whether the
that the controls are operating effectively organization
service organization’s controls are designed
and provides limited benefits to a 404
and operating effectively. One starting point
assessment.
is to obtain a service auditor’s report on
controls in operation at the service

MANAGEMENT’S ASSESSMENT PROCESS 5

How recent should an SAS 70 Type II The extent of procedures necessary to compliance with applicable laws and
report from a third-party service update the SAS 70 Type II report will vary regulations, with the exception of
provider be in order to be considered depending on the amount of time between compliance with the applicable laws and
reliable?
the date of the service auditor’s report and regulations directly related to the
There is no precise answer as to how recent
management’s assessment. Also, PCAOB preparation of financial statements.
an SAS 70 Type II report should be to be
Auditing Standard No. 2 indicates that if Accordingly, we do not believe that the
considered reliable. However, if a
management has identified changes, the preparation of tax returns is contemplated in
significant period of time has elapsed
independent auditor should determine the definition of internal control over
between the end of the time period covered
whether management has performed financial reporting. However, the SEC staff
by the service auditor’s tests of controls and
procedures to evaluate the effect of any did indicate that the SEC’s financial
the date of management’s assessment,
identified changes on the effectiveness of reporting requirements and the Internal
management should perform procedures to
the company’s ICOFR. Revenue Code are examples of regulations
determine whether any information in the
that are directly related to the preparation of
SAS 70 Type II report should be updated to To what extent are taxes included the financial statements.
reflect significant changes in the service within the scope of management’s
organization’s controls since the date of the assessment? How should current-year acquisitions
SAS 70 report. The procedures should cover Taxes can be one of the largest expenses on a and divestments be treated?
the period from the end of the time period company’s income statement, and tax assets As for current-year acquisitions, the SEC
referred to in the SAS 70 Type II report to and liabilities (both current and deferred) staff’s frequently asked questions indicated
the date of management’s assessment. often are significant to the balance sheet. In they would typically expect management’s
addition, taxes can exist at the account- or report on ICOFR to include controls at all
PCAOB Auditing Standard No. 2 states that disclosure-component level in the form of consolidated entities. The SEC staff
the independent auditor should inquire of compensation, transaction, and property- acknowledged that it might not be possible
management to determine whether based taxes. Because taxes could have a to conduct an assessment of an acquired
management has identified any changes in significant impact on financial reporting, business’s ICOFR in the period between the
the service organization’s controls management should not ignore tax processes transaction consummation date and the date
subsequent to the period covered by the as part of its assessment of ICOFR. of management’s assessment. In these
service auditor’s report. These may include: instances, the SEC staff indicated they
• Changes communicated by the service Moreover, there is often an assumption that would not object to management excluding
organization to management the scope of tax inclusion in management’s from its evaluation of ICOFR business
• Changes in service organization assessment should focus only on processes acquisitions for a period not to exceed one
personnel with whom management related to income taxes, such as corporate year from the date of acquisition. In these
interacts income taxes and the tax provision. In instances, the SEC staff indicated that
• Changes in reports or other data received reality, nonincome taxes—such as those management should refer to
from the service organization related to sales or value-added taxes as well (1) a discussion in the registrant’s Form 10-
• Changes in contracts or service-level as those related to accounting for K or Form 10-KSB regarding the scope of
agreements with the service organization intercompany, customs, and cross-border the assessment and (2) such disclosure,
• Errors in the service organization’s transactions—could be an integral part of noting that management excluded the
processing other key financial processes. acquired business from management’s
report on ICOFR. If such a reference is
In their frequently asked questions, the made, however, management must identify
staffs of the SEC’s Chief Accountant and the acquired business that was excluded and
Division of Corporation Finance (the SEC indicate the significance of the acquired
staff) indicated they believe the definition of business to the company’s consolidated
ICOFR does not encompass a registrant’s financial statements.

6 SARBANES-OXLEY SECTION 404

The SEC staff indicated that When a company undertakes an initial ICOFR ordinarily would be performed
notwithstanding management’s exclusion of public offering, should the company pursuant to the provisions of PCAOB
an acquired business’s internal controls include management’s assessment on Auditing Standard No. 2.
the effectiveness of ICOFR and a
from its annual assessment, a company
related auditor’s report on internal
must disclose any material change to its To what extent is it appropriate for
control in an initial registration
internal control over financial reporting that management to discuss areas of the
statement filed on Form S-1?
financial accounting and reporting
is due to the acquisition pursuant to either No. Form S-1 filed pursuant to an initial process with the company’s
Exchange Act Rule 13a-15(d) or Exchange registration of securities does not require independent auditor?
Act Rule 15d-15(d). In addition, the period the inclusion of the information required Consultation with the independent auditor
in which management may omit an by Item 308 (Internal Control Over about accounting and reporting issues
assessment of an acquired business’s Financial Reporting) of Regulation S-K. facilitates audit quality. Accordingly, we
internal control over financial reporting The SEC’s Final Rule, Management’s believe that it is important for company
from its assessment of the company’s Reports on Internal Control Over management to continue to freely consult
internal control may not extend beyond one Financial Reporting and Certification of with the company’s independent auditor
year from the date of acquisition. Such Disclosure in Exchange Act Periodic regarding these kinds of issues. However,
assessments also may not be omitted from Reports, impacts entities subject to the the independent auditor’s advice cannot
more than one annual management report reporting requirements of the Securities serve as a substitute for management
on internal control over financial reporting. Exchange Act of 1934. Section 404 of the performing its own responsibilities.
There is currently no guidance from the Sarbanes-Oxley Act applies to a registrant Management remains responsible for the
SEC or PCAOB that specifically addresses for the first annual report after the entity selection and application of accounting
how management should treat divestments becomes an “issuer” (after consideration of policies and practices and the design and
for the purposes of section 404. However, the effective dates of the SEC’s Final Rule effective operation of controls over the
management’s assessment of the with respect to accelerated and entity’s financial reporting process.
effectiveness of the company’s ICOFR is nonaccelerated filers).
“as of ” the end of the company’s most
recent fiscal year. Therefore, to the extent a Paragraph 2 of PCAOB Auditing Standard
company divests part of its operations prior No. 2 indicates that section 404 applies to
to the end of the most recent fiscal year, an “issuer” as defined in section 3 of the
internal controls over financial reporting at Securities Exchange Act of 1934, which
the divested operation would be excluded includes enterprises that file or have filed a
from management’s assessment for registration statement (i.e., Form S-1) with
purposes of section 404 of Sarbanes-Oxley. the SEC that has not been declared
effective under the Securities Act of 1933
If management chooses to exclude a and has not been withdrawn. While this
business unit from documentation and language has created some confusion, the
testing due to the business unit’s planned SEC staff has confirmed that Item 308 of
divestiture, management should be certain Regulation S-K does not apply to an initial
that the divestiture will take place prior to registration of securities filed on Form S-1.
the company’s fiscal year-end. Otherwise,
the processes and controls for that business An entity undertaking an initial public
unit should be documented, tested, and offering may voluntarily assess the
included in management’s assessment as of effectiveness of its ICOFR and ask its
the company’s fiscal year-end. independent auditor to perform an audit of
ICOFR. In such instances, the audit of

MANAGEMENT’S ASSESSMENT PROCESS 7

Section II. Documenting and Should management test and evaluate The purpose for this control categorization
all controls that have been identified exercise is to identify those controls
Evaluating the Design and through ICOFR documentation? necessary to provide management with the
Operating Effectiveness of Management should test those controls that appropriate level of evidence regarding
it considers important to its evaluation and relevant assertions related to the affected
Controls assessment of ICOFR. PCAOB Auditing account balances and disclosures in the
Standard No. 2 indicates that (1) the financial statements. Once the controls are
The documentation and evaluation independent auditor should evaluate prioritized, management can determine the
of ICOFR is an essential part of management’s process for determining tests of operating effectiveness necessary
management’s assessment which controls should be tested and (2) to support its assessment of the
process. It provides evidence that these controls generally include: effectiveness of ICOFR.
controls related to management’s • Controls over initiating, authorizing,
assessment have been identified, recording, processing, and reporting To assist with this “categorization”
can be communicated to those accounts and disclosures and related process, many companies are finding it
responsible for their performance, assertions embodied in the financial useful to review process flows and other
and can be monitored. Additionally, statements documentation in order to identify the
the results of management’s • Controls over the selection and points in the process where errors or fraud
evaluation of the design and application of accounting policies that are are most likely to occur. Once a specific
operating effectiveness of controls in conformity with generally accepted point has been identified, management can
must be documented. Some accounting principles select controls at that point or after that
examples of issues that may arise • Antifraud programs and controls point in the flow for testing. After the
during this step are included here. • Controls, including information controls have been selected, management
technology general controls, on which should review all the controls it has
other scontrols depend identified to verify that relevant assertions
• Controls over nonroutine and for the related account have been
nonsystematic transactions, such as satisfactorily addressed.
accounts involving judgments and
estimates Note: Due to the significance of this
• Company-level controls, including determination in management’s assessment
– The control environment process, it is important for management to
– Controls over the period-end financial have regular meetings with its independent
reporting process (both annual and auditor to discuss and obtain agreement on
quarterly) the process that management has used to
identify key controls.
To date, many companies have identified a
large number of controls during their What controls are considered to be
ICOFR documentation. In some cases, company-level controls and how
there are multiple controls that address the should these be evaluated?
same control objective and assertion. To Company-level controls often have a
help management identify appropriate pervasive impact on controls at the process,
controls for testing and to support its transaction, or application levels. As part of
assertion about ICOFR effectiveness, the assessment process, management
companies are finding it useful to prioritize should consider the extent to which
controls for testing by designating them company-level controls will be
“key,” “primary,” or “high, medium, and documented and tested. These include the
low.” following:

8 SARBANES-OXLEY SECTION 404

• Controls within the control environment, Determining whether sufficient company- How does management determine
including tone at the top, authority and level controls exist is a matter of whether a control is designed
responsibility assignment, policy and management judgment. However, to make effectively?

procedure consistency, and an informed decision, management should Tests of design are performed to determine
companywide programs (such as codes follow a two-step process. First, it should whether controls, if operating properly, can
of conduct and fraud prevention) that determine the nature and extent of controls effectively prevent or detect misstatements
apply to all locations and business units. that need to be in place to accomplish the in the entity’s financial records. Tests of
Also included are board-approved objectives of the organization. Then it design are usually performed by inquiry
policies that address significant business should decide whether these controls are and validating observation or inspection of
control and risk management practices. designed and operating effectively. documents, such as reports and completed
• Management’s risk assessment process. forms; through on-screen prompts, such as
• The period-end financial reporting Management should note that testing errors or warnings; or, most effectively, by
process. company-level controls alone is not performing a process “walkthrough.”
• Monitoring of operations results; sufficient for management to conclude on
internal audit function, audit committee, whether ICOFR is effective. Although management is not required to
and self-assessment program activities; perform them, process walkthroughs can
and centralized processing, such as help management:
shared service environments. • Confirm its understanding of the process
flow of transactions
• Confirm its understanding of the design
of controls identified for all five
IDENTIFYING CONTROLS FOR TESTING components of internal control over
financial reporting, including those
CP1
Billing specialist related to the prevention and detection of
prepares customer Billing supervisor
reviews the invoice fraud
invoice, based on
customer agreement for clerical accuracy • Confirm that its understanding of the
and terms of sale. and proper terms
of sale. process is complete by determining
whether all points in the process at
which misstatements related to each
CP2 relevant financial statement assertion
Billing specialist
ERROR
Billing manager could occur have been identified
investigates and YES NO reviews invoice for
corrects invoice. IDENTIFIED?
accuracy, pricing, • Evaluate the effectiveness of the design
terms, etc. of controls
• Confirm whether controls have been
placed in operation

ERROR
Tests of design typically address:
Invoice is mailed
YES NO
IDENTIFIED? to the customer. • Control type, including configuration,
management review, and authorization
• Control nature (whether automated or
As shown in the chart above, management may view control point 2 (CP2) as a strong, reliable manual, preventive or detective)
control. What’s more, if the CP2 control is operating effectively, testing of CP1 may be • Control frequency (daily, weekly,
redundant and therefore unnecessary. (By the same token, CP1 may be operating effectively, monthly)
and testing of CP2 may be redundant and unnecessary.) Generally, personnel closely involved • Experience and competence of the
with the process and controls should be involved in identifying controls to be tested. individual performing the control

MANAGEMENT’S ASSESSMENT PROCESS 9

• Error investigation and correction When determining the extent of testing It is management’s responsibility to
procedures, including the timeliness of procedures to perform, management should determine the extent of testing—or sample
such procedures take into account the nature of the control, sizes—that it considers sufficient to
its frequency of operation, and the overall support its assessment of the effectiveness
It is important to note that inquiry alone significance of the control. of internal control over financial reporting.
ordinarily is not sufficient to support
design effectiveness. The extent of testing also depends on the Management should base its decision on all
risk of failure of the control being tested. of these factors. The table on this page
When testing operating Risk of failure is defined as the risk of a illustrates examples of minimum sample
effectiveness, how much testing material misstatement arising from the sizes for consideration when planning the
should management perform? What
failure of a control. If management extent of test work on manual control
testing sample sizes should be used?
believes there is a high risk of failure, operating effectiveness. Management’s
The amount of testing depends on a
management should consider expanding determination of minimum sample sizes
number of factors. However, it should be
the extent of testing for that control. should not be based on the examples shown
comprehensive enough to support
in the table; management should select
management’s assessment of the
Factors that affect whether the control may sample sizes that will provide it with
effectiveness of internal controls. This
represent a higher risk of failure include: sufficient evidence based on the company’s
should include considering all relevant
• Changes in the volume or nature of specific facts and circumstances.
assertions for each account and disclosure
transactions that might adversely affect
included in the scope of management’s
control design or operating effectiveness In situations where a control that is applied
assessment. In general, management’s
• Changes in the design of controls to every transaction is automated through
testing should be more extensive than that
• The degree to which the control relies the IT system, a system query may be the
of the independent auditor. This doesn’t
on the effectiveness of other controls most appropriate testing technique. With
mean that in all cases management’s
(for example, the control environment or this technique, one query may be an
sample sizes for a single control at a single
IT general controls) appropriate test for an IT control that
location would be larger than those of the
• Changes in key personnel who perform would be expected to operate consistently
auditor. It simply means that management’s
the control or monitor its performance in a well-controlled environment. System
testing, taken as a whole, should be more
• Whether the control relies on perform- query may be used to test operating
comprehensive and potentially cover more
ance by an individual or is automated effectiveness if management is satisfied
processes, controls, accounts, and business
• The complexity of the control with the results of the test of design.
units or locations.

System queries can be used to:

• Test whether programmed logic
surrounding a control contained within an
IT application is operating as expected,
EXAMPLE MINIMUM TESTING SAMPLE SIZES that is, whether the system will identify a
predefined exception.
CONTROL OPERATING MINIMUM CONTROL OPERATING SAMPLE • Retrieve information from an IT
FREQUENCY SAMPLE SIZE FREQUENCY SIZE
application about the configuration or
Annual 1 Weekly 5–10 designations within the system. For
example, management could query the
Quarterly 2–3 Daily 15–30
application to determine how tolerance
Monthly 2–4 Recurring manual 30–60 limits were configured or to obtain a list
control (multiple of individuals who have authority to
times per day)
perform a certain function in the system
in order to evaluate segregation of duties.

10 SARBANES-OXLEY SECTION 404

Does an independent auditor individuals performing the work as well as
distinguish between testing the quality and effectiveness of
performed by internal audit and documentation supporting management’s
testing performed by management?
assessment.
The independent auditor must perform
enough of the test work supporting its
Factors generally affecting the independent
opinion so that the auditor’s own work
auditor’s decision to use the work of others
provides the principal evidence for the
include aspects of the nature of the control,
auditor’s opinion. Keeping this principal
such as the:
evidence requirement in mind, the
• Materiality of the accounts and
independent auditor also may use the work
disclosures that the control addresses as
of others in an audit of ICOFR.
well as the risk of material misstatement
• Degree of judgment required to evaluate
While the independent auditor isn’t
the operating effectiveness of the control
required to use work performed by others,
• Pervasiveness of the control
the independent auditor may, in certain
• Level of judgment or estimation required
areas, choose to do so based on the:
in the account or disclosure program development controls, this
• Objectivity and competence of the
• Potential for management override of the documentation may form the basis of
individual who performed the work
control management’s assessment and testing. In
• Quality and effectiveness of the work
• Nature of the controls tested by other these cases, management should also have
There are areas in which the independent sufficient documentation of the program
individuals
auditor cannot use the work of others. change controls from the date of
• Timing of the work performed
These areas include walkthroughs and installation through the current date.
• Results of auditor’s re-performance of
testing of control operating effectiveness
certain work performed by others
related to the control environment, Consistent with the provisions of PCAOB
including controls specifically designed to Auditing Standard No. 2, management
For example, if an individual responsible
prevent and detect fraud. should demonstrate that it has a thorough
for a control’s operation also tests the
control’s operating effectiveness testing, understanding of how all significant
Many organizations have IT systems
this personal self-assessment will not be classes of transactions are initiated,
and applications that were installed
considered objective. As a result, the prior to the current year. Should authorized, processed, recorded, and
independent auditor cannot use this work management test the design and reported. That understanding should be
in performing its independent assessment. operating effectiveness of the documented in sufficient detail to facilitate
program development general IT performance of a process or transaction
controls for these systems and
If members of the internal audit walkthrough. Management should perform
applications?
department (or other individuals who work sufficient tests of systems installed in prior
All systems and applications that support
under the direction of management and are years to help ensure that significant
financial reporting processes should have
not responsible for control operation) accounting processes (calculations,
the appropriate general IT controls in
perform the testing, the work generally will postings, etc.) are functioning properly and
place, including program development
be considered to be more objective than the significant application controls are
controls. Management should evaluate
work performed by those who are operating as intended.
these program development controls.
responsible for the control operation (e.g.,
control self-assessment). Of course, the When management has the original
independent auditor still evaluates the documentation from the initial installation
objectivity and competence of the of an application or system relating to

MANAGEMENT’S ASSESSMENT PROCESS 11

 not require the same rigors of general IT How can management judge whether
controls as other systems, these controls company-level controls are operating
should be appropriate to help ensure the effectively?

completeness and accuracy of reported Ordinarily, it is not possible to test the

data, consistency of presentation, proper company-level controls without visiting
calculation and validation, and security that some or all of the locations or business
is appropriate to the significance and units over which they operate. The
complexity of the report or spreadsheet. effectiveness of some company-level
controls, such as the implementation of a
Which controls should be tested for code of conduct or application of
the period-end financial reporting accounting manuals, relies on evidence
process? that is obtained outside of the central or
Since the period-end financial reporting corporate office.
process is so significant, understanding
and evaluating it is critical. This process The number of locations or business units
includes the procedures used to: that are included in the testing is a matter
• Enter transaction totals into the general of judgment. When determining the
ledger number of locations to visit, management
Does S-O 404 require additional • Initiate, authorize, record, and process may consider factors such as the degree of
controls for flexible ERP reporting, journal entries in the general ledger centralization of controls, the commonality
spreadsheets, and other types of
• Record recurring and nonrecurring of process and control design between
end-user computing?
adjustments to the annual and quarterly locations, and the consistency of
End-user computing applications, such as
financial statements, such as accounting policies or job descriptions.
spreadsheets and reports, may present an
consolidating adjustments, report Obviously, locations that are included in
organization with a unique set of IT
combinations, and classifications the testing should be representative of the
general control needs. This is because
• Draft annual and quarterly financial populations of locations or business units
providing end users with these types of
statements and related disclosures that are considered to be important when
flexible tools typically increases the risk of
misstatements caused by errors due to aggregated. In addition, the extent of the
As part of its assessment process, test work should be greater than that
incomplete or inaccurate data. Since the
management should test controls over each performed by the independent auditor.
output from end-user computing processes
of the items listed above. This testing should
frequently appears as an authoritative
be performed on the controls used to
document that management will rely on in
produce both annual and quarterly financial
its financial reporting, end-user computing
information.
applications that support significant
internal controls should be identified and
Management should take care to identify
included in control documentation.
and test both the manual and automated
controls that are included in the period-end
The organization should support end-user
financial reporting process. In addition, it
computing with general controls that are
should evaluate the nature and extent of
consistent with the level of sophistication
oversight by all appropriate parties,
of the system. General controls should
including management, the board of
address areas such as access to programs
directors, and the audit committee.
and data, program changes, program
development, and computer operations.
While end-user computing generally does

12 SARBANES-OXLEY SECTION 404

Section III. Identifying, Can a material weakness in ICOFR exist determine the extent of testing necessary to
when a material misstatement conclude on the effectiveness of a remedied
Assessing, and Correcting in the financial statements has not control.
occurred or been identified?
Deficiencies
Yes, a material weakness in ICOFR can exist
For example, management may have an
even though a material misstatement in the
Management should establish a established policy governing the extent of
financial statements has not occurred or been
process through which all testing, such as the size of samples to be
identified. The significance of a deficiency in
deficiencies in ICOFR across the tested. Management considers this sample
ICOFR depends on the potential for
entire company are identified and adequate to support its assertion about the
misstatement, not on whether a misstatement
accumulated. This will help effectiveness of internal control over financial
actually has occurred. Thus, management and
management conclude its reporting. In this example, management’s
its independent auditor may conclude that a
assessment of ICOFR effectiveness policy states that a manual control that
material weakness in ICOFR exists even if a
by evaluating the severity of all operates daily should have sixty3 occurrences
material misstatement has not occurred or
identified deficiencies. Among the tested. If management identifies a deficiency
been identified.
questions that may come up during and remedies the control, it should allow
this phase are the following. enough time for at least sixty occurrences of
If management replaces or redesigns a
deficient control, how long should the the remedied control to be tested for operating
new control operate and how much effectiveness.
testing should management perform to
determine whether or not it is operating Will a number of multiple significant
effectively? deficiencies automatically translate into
Management should allow sufficient time to a material weakness in ICOFR?
evaluate and test controls. If deficiencies are Not necessarily. Based on the guidance in
discovered, management may have the paragraph E90 of PCAOB Auditing Standard
opportunity to correct and address these No. 2, a specific number of significant
deficiencies prior to the reporting date. deficiencies will not necessarily determine the
However, once a new control is in place, existence of a material weakness in ICOFR.
management should allow enough time for its However, all significant deficiencies should
operations to validate the control’s operating be evaluated to determine whether they,
effectiveness. individually or when aggregated with other
significant deficiencies, result in material
The amount of time that a control should be weaknesses in ICOFR.
in place and operating effectively depends on
the nature of the control and how frequently it There are a number of factors that might be
operates. Under ordinary circumstances, considered when aggregating deficiencies,
control remediation that occurs after year-end including whether the significant deficiencies:
will not mitigate an identified deficiency for • Affect the same financial statement
reporting purposes. PCAOB Auditing account or disclosure
Standard No. 2 indicates that the independent • Impact a common assertion in a financial
auditor should disclaim an opinion on statement account or disclosure
management’s disclosure about corrective
actions taken by the company after the date of Are there any general guidelines that
have been developed to define “more
management’s report. Management should
than inconsequential” when identifying
look to its established testing protocols to significant deficiencies?

3
The sample sizes in this discussion are presented for illustrative purposes only. Management’s determination of sample sizes should not be
based on the example discussed above; instead management should select a sample size that will provide it with sufficient evidence based on
the company’s specific facts and circumstances.

MANAGEMENT’S ASSESSMENT PROCESS 13

PCAOB Auditing Standard No. 2 defines a deficiency exists includes both the quantitative risks. For example, in capital assets
significant deficiency as a control deficiency and qualitative analysis of whether the procurement processes, approvals may be
or a combination of control deficiencies that deficiency is more than remote and more than required for the business case, request for
result in “more than a remote likelihood” that a inconsequential. Accordingly, there may be proposals, vendor selection, purchase orders,
“more than inconsequential” misstatement of instances when potential misstatement amounts receiving reports, invoices, and checks. Each of
an entity’s annual or interim financial that are less than the quantitative measure these approvals has a valid operational or
statements will not be prevented or detected. noted above also may be considered “more compliance objective. However, only one of
than inconsequential,” depending on these approvals may provide the necessary
The definition of inconsequential includes a management’s judgment of these qualitative safeguarding control for purposes of
combination of concepts from Staff factors (e.g., potential misstatements involving management’s S-O 404 requirements and,
Accounting Bulletin (SAB) No. 99, related-party transactions). accordingly, the extent of testing may vary
Materiality, and AU section 312. The definition from control to control.
of inconsequential is largely based on the How can management identify controls
discussion of magnitude in SAB No. 99 and on that relate to safeguarding assets? How This does not mean that all authorization
are deficiencies evaluated?
AU sec. 312 for its directions regarding the controls can be considered safeguarding
COSO defines “safeguarding” assets as
consideration of misstatements both controls. For example, under ordinary
including controls that provide reasonable
individually and in the aggregate as well as the circumstances, authorizing journal entries is
assurance of preventing or detecting
possibility of undetected misstatements. A not considered a safeguarding control, as
unauthorized acquisition, use, or disposition of
misstatement is inconsequential if a reasonable failure to authorize the journal entry generally
the company’s assets that could have a material
person would conclude, after considering the would not expose the company to misuse or
effect on the financial statements. Safeguarding
possibility of further undetected misstatements, misappropriation of company assets. The first
does not refer to the company’s business
that the misstatement, either individually or consideration in determining if a control is a
continuity or contingency plans, or to the
when aggregated with other misstatements, safeguarding control is whether there is the
physical protection of assets or controls over
would clearly be immaterial to the financial potential for inappropriate or unauthorized use
making bad business decisions.
statements. If a reasonable person could not of company assets. Where this potential exists,
reach such a conclusion regarding a particular the risk related to safeguarding should be
This means it is important to determine
misstatement, that misstatement is more than documented. In addition, management should
whether the use of company assets is
inconsequential. recognize such risks when analyzing financial
authorized, not whether the use was a good or
reporting processes.
bad business decision. For example,
The significance of a deficiency in internal
safeguarding assets as defined by COSO does
control depends on the potential for Once a deficiency in safeguarding controls is
not contemplate losses from providing a
misstatement, not necessarily on whether a identified, the key consideration for the
service at an unreasonable cost, as long as it is
misstatement actually has occurred. For purposes of management’s assessment is
authorized. The same is true of losses from
purposes of evaluating the quantitative whether such an action could result in a
authorized but unproductive research or
significance of potential misstatements that financial statement misstatement, not whether
ineffective advertising.
result from internal control deficiencies, one the financial statements are misstated. The key
general guideline for determining “more than factor is the magnitude of the potential for
Management should identify the risks within
inconsequential” is whether there are potential unauthorized use of company assets in any
each key process of unauthorized acquisition,
misstatements that equal or exceed 1 percent of particular instance. For example, an employee
use, or disposition of the company’s assets that
pretax earnings. In evaluating the magnitude of may be able to enter into a contract binding the
could have a material effect on the financial
identified internal control deficiencies, it is company to purchase certain material
statements. It should also test those controls
important to note that the concept contemplates inventory items without the required
that mitigate those risks, including not only
an analysis of misstatements that could occur, management authorization. Even if the
controls over the appropriate signing
not that have occurred. purchase is properly recorded in the financial
authorities but also controls to ensure that the
statements, a lack of authorization may
proper authorization occurs.
Management also should remember that the constitute a deficiency in internal control over
determination of whether a significant financial reporting.
A process can be subject to many safeguarding

14 SARBANES-OXLEY SECTION 404

Section IV. Reporting on Many companies provide their
independent auditors with draft
Internal Controls financial statements for review prior
to company approval. How can a
company demonstrate to the auditor
Management is required to include
that it would have picked up an error
its assessment of the effectiveness of noted in the draft financial
the company’s ICOFR in its annual statements that would otherwise
report. Management’s report on result in a material weakness or
ICOFR is required to include the significant deficiency?
following: Using the guidance issued by the PCAOB
• A statement of management’s staff, the answer to this question depends
responsibility for establishing and on the stage at which management presents
maintaining adequate ICOFR for the draft financial statements to the
the company independent auditor and the independent
• A statement identifying the auditor’s knowledge of the company’s
framework used by management financial reporting process.
to conduct the required deadlines for their annual reports. The
assessment of the effectiveness of To expedite the audit process and the PCAOB staff also indicated that when
the company’s ICOFR financial reporting process, many companies combined with the accelerated filing
• An assessment of the effectiveness provide an early draft to their independent deadlines, this type of process might put
of the company’s ICOFR as of the auditor. The independent auditor’s the auditor under increased pressure to
end of the company’s most recent comments on the company’s draft financial complete the audit of the financial
fiscal year, including an explicit statements are part of the iterative process statements in too short a period of time. As
statement as to whether that of completing the audit. If management a result, this approach could impair, rather
ICOFR is effective presents the draft financial statements to than improve, audit quality. Therefore,
• A statement that the registered the independent auditor at a later stage in some type of timely information sharing
public accounting firm that audited the financial reporting process and between management and the auditor is
the financial statements included purports that the company’s review process preferable.
in the annual report has issued an is complete or nearly complete, the
attestation report on independent auditor generally would It is common for management to share
management’s assessment of the conclude that material deficiencies in the interim drafts of the company’s financial
company’s ICOFR draft financial statements are indicative of statements with the independent auditor.
a material weakness in the company’s In these cases, it is important that
ICOFR. management clearly communicate to the
company’s independent auditor:
One way to demonstrate management’s • The state of completion of the financial
belief that the company’s controls are statements
operating effectively is by modifying the • The purpose for which the company is
traditional audit process to provide the providing the draft financial statements
independent auditor with just a single draft to the auditor
of the financial statements. However, this
process is not necessarily the approach Question 7 of the PCAOB’s Staff
that was expected as a result of the Act. Questions and Answers provides additional
Nor is it very practical in many situations. guidance and examples of appropriate
The PCAOB staff has indicated that such involvement by the auditor when reviewing
a process might make it difficult for some draft financial statements.
companies to meet the accelerated filing

MANAGEMENT’S ASSESSMENT PROCESS 15

 Conclusion

It is clear that Sarbanes-Oxley section 404 presents management with a number of

challenges. We believe that an ideal approach to meeting these challenges is to
open a wide-ranging discussion—among management, independent auditors,
members of corporate S-O 404 compliance teams, and audit committee
members—in which all can come together to develop appropriate guidelines for
addressing management’s responsibilities in assessing internal control over
financial reporting.

We hope this document contributes to that conversation and offers management,

directors, and audit committee members a useful perspective in meeting their
challenges.

16 SARBANES-OXLEY SECTION 404

Contacts

If you would like further information about the challenges that directors and audit
committee members face in meeting the increasing demand for good corporate
governance practices, please visit KPMG's Audit Committee Institute Web site
http://aci.kpmg.com.hk or contact the following individuals at our KPMG offices
in China and Hong Kong:

Hong Kong Beijing

Carlson Tong David Ko

Partner in charge Partner
Audit and Risk Advisory Services Risk Advisory Services

Tel: +852 2826 7235 Tel: +86 (10) 8518 9234

Fax: +852 2845 2588 Fax: +86 (10) 8518 5111
Email: [email protected] Email: [email protected]

Hong Kong Shanghai

Stephen Lee Alvin Wai

Partner in charge Partner
Risk Advisory Services Risk Advisory Services

Tel: +852 2826 7267 Tel: +86 (21) 6288 1922

Fax: +852 2845 2588 Fax: +86 (21) 6288 1889
Email: [email protected] Email: [email protected]

Hong Kong Guangzhou

Michael Lai Ronald Sze

Director Partner
Risk Advisory Services Risk Advisory Services

Tel: +852 2978 8943 Tel: +86 (20) 3758 8530

Fax: +852 2845 2588 Fax: +86 (20) 8732 2883
Email: [email protected] Email: [email protected]