How to Comply With Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control

5.1. IMPORTANCE OF DOCUMENTATION

The adequate documentation of internal control is important for two reasons:

1. To enable effective monitoring. The risk-based, top-down approach described in Chapters 1 and 3 emphasize the need for strong monitoring controls. In some cases, management's ongoing monitoring activities may be the only control that needs to be evaluated and tested for a given account or class of transactions. However, in order for monitoring to work at a high level of precision, the design and performance of the control should be documented. A supervisor cannot monitor the performance of a bank reconciliation if there are no bank reconciliations to review. You should distinguish between the documentation of the control and the documentation of management's tests of control effectiveness. The documentation of internal control facilitates management's evaluations. The documentation of management's tests provides the support for management's conclusion about internal control effectiveness. This chapter discusses the documentation of internal controls. Chapters 5 and 6 describe the documentation of management's tests.

2. To improve reliability of internal control. Documentation of internal control policies and procedures improves the effectiveness and reliability of internal control. Without adequate documentation, the performance of the system depends exclusively on the skills and competence of the individual responsible for performing the control procedure. As such, performance ...