How to Comply With Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control

5.7. Appendix 5A Action Plan: Documentation

This action plan is intended to help you implement the chapter's suggestions for evaluating an entity's documentation of its internal control.

5.7.1. Assess Existing Documentation

Determine whether existing documentation is sufficient to evaluate the design and plan tests of operating effectiveness. For example:

• Determine that documentation exists for all significant control objectives.

  • If documentation does not exist, then determine whether: (a) controls do not exist, or (b) ad hoc, informal controls exist but have not been documented.

  • If controls do not exist, design, document, and implement new control procedures.

  • If controls exist but are not documented, document existing controls.

• Determine that documentation contains these elements:

  • A link between the control objective and the control policy or procedure.

  • A description of the control policy or procedure that achieves the control objective.

Appendix 5B includes example control policies and procedures, organized by significant control objective.

• Information about:

  • How transactions are initiated, recorded, processed, and reported.

  • The flow of transactions to identify where material misstatements due to error or fraud could occur.

  • A description of:

    • How the control procedure is to be applied.

    • Who is responsible for performing the procedure.

    • How frequently the procedure is performed.

5.7.2. Evaluate Automated Documentation Tool

Assess the adequacy of the documentation warehouse of the entity's ...