The Sarbanes–Oxley Section 404 Implementation Toolkit

About the Author vii
<p>Preface ix</p>
<p>Acknowledgments xi</p>
<p>Part I Tools for Management 1</p>
<p>ADM–1 General Work Program 3</p>
<p>ADM–2 Project Planning Summary 17</p>
<p>ADM–2a Checklist for Summarizing Project Team Competence and Objectivity 31</p>
<p>ADM–2b.1 Worksheet for Determining and Documenting Significant Accounts and Disclosures 34</p>
<p>ADM–2b.2 Mapping of Business Processes to Significant Accounts and Disclosures 40</p>
<p>ADM–2c Example Inquiries to Identify Changes to Internal Control 45</p>
<p>ADM–3 Senior Management Review Checklist 47</p>
<p>ADM–4 Checklist for Preparation of Management′s Report on Internal Control Effectiveness 52</p>
<p>Part II Documentation of Internal Control Design 57</p>
<p>DOC–1 Work Program for the Review of Documentation of Entity–Level Controls 59</p>
<p>DOC–1a Assessment of Internal Control Effectiveness: Overall Approach to Review of the Documentation of Entity–Level Controls 62</p>
<p>DOC–1b Assessment of Internal Control Effectiveness: Checklist for the Review of the Documentation of Entity–Level Controls 66</p>
<p>DOC–2 Work Program for the Review of Documentation of Activity–Level Controls 80</p>
<p>DOC–2a Assessment of Internal Control Effectiveness: Overall Approach to Review of the Documentation of Activity–Level Controls 82</p>
<p>DOC–2b Assessment of Internal Control Effectiveness: Checklist for the Review of the Documentation of a Significant Transaction or Business Unit/Location 85</p>
<p>DOC–3 Documentation Techniques and Selected Examples for Routine Transactions 87</p>
<p>DOC–4 Checklist for Evaluating SOX 404 Software 110</p>
<p>Part III Internal Control Testing Programs 113</p>
<p>Entity–Level Controls Testing Tools 115</p>
<p>TST–ENT–1 Summary of Observations and Conclusions about Entity–Level Control Effectiveness 119</p>
<p>TST–ENT–1a Checklist for Small Business Entity–Level Controls 135</p>
<p>TST–ENT–2 Work Program for Testing Entity–Level Control Effectiveness 143</p>
<p>TST–ENT–3 Index to Tests of Entity–Level Controls: Inquiries and Surveys 171</p>
<p>TST–ENT–3a Entity–Level Tests of Operating Effectiveness: Inquiry Note Sheets Management 176</p>
<p>TST–ENT–3b Entity–Level Tests of Operating Effectiveness: Inquiry Note Sheets Board Members 187</p>
<p>TST–ENT–3c Entity–Level Tests of Operating Effectiveness: Inquiry Note Sheets Audit Committee Members 193</p>
<p>TST–ENT–3d Entity–Level Tests of Operating Effectiveness: Inquiry Note Sheets Employees 200</p>
<p>TST–ENT–3e Example Employee Survey 207</p>
<p>TST–ENT–4 Index to Tests of Entity–Level Controls: Inspection of Documentation 215</p>
<p>TST–ENT–4a Worksheet to Document Inspection of Documentation of Performance of Entity–Level Controls 217</p>
<p>TST–ENT–5 Index to Tests of Entity–Level Controls: Observation of Operations 220</p>
<p>TST–ENT–5a Worksheet to Document Observation of Operation of Entity–Level Controls 222</p>
<p>TST–ENT–6 Index to Tests of Entity–Level Controls: Reperformance of Controls 225</p>
<p>TST–ENT–6a Worksheet to Document Reperformance of Entity–Level Controls 227</p>
<p>TST–ENT–7 Work Program for Reviewing a Report on IT General Control Effectiveness 230</p>
<p>TST–ENT–7a Planning and Review of Scope of Tests of IT General Control Effectiveness 235</p>
<p>TST–ENT–8 Work Program for Performing an IT General Controls Review 241<br /> Guidelines for Testing Activity Level Control Effectiveness 245</p>
<p>TST–ACT–1 Guidelines and Example Inquiries for Performing Walkthroughs 253</p>
<p>TST–ACT–2 Example Testing Program for Activity–Level Tests of Controls 261</p>
<p>TST–ACT–2a Example Testing Program for Control Operating Effectiveness: Revenue 262</p>
<p>TST–ACT–2b Example Testing Program for Control Operating Effectiveness: Purchases and Expenditures 267</p>
<p>TST–ACT–2c Example Testing Program for Control Operating Effectiveness: Cash Receipts and Disbursements 271</p>
<p>TST–ACT–2d Example Testing Program for Control Operating Effectiveness: Payroll 275</p>
<p>TST–ACT–3 Work Program for the Review of a Type 2 SAS No. 70 Report 279</p>
<p>TST–ACT–3a Type 2 SAS No. 70 Report Review Checklist 282</p>
<p>TST–ACT–4 Process Owners Monitoring of Control Effectiveness 289</p>
<p>Part IV Example Letters and Other Communications 295</p>
<p>COM–1 Example Engagement Letter for Outside Consultants to Management 297</p>
<p>COM–2 Example Management Representation Letter 301</p>
<p>COM–3 Example Management Reports on Effectiveness of Internal Control over Financial Reporting 303</p>
<p>COM–4 Example Subcertification 305</p>
<p>Appendix A 307</p>
<p>About the CD–ROM 385</p>
<p>Index 389</p>