How to Comply With Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control

4.2. INFORMATION GATHERING FOR DECISION MAKING

Several key questions will arise during the engagement that you will want to consider early on in order to gather the necessary information. Broadly, these key questions are:

• What is the best way to organize your project?

• What areas should receive the most attention?

• What is a "significant deficiency" or "material weakness" in internal control?

• What is the overall scope of the project, and what work has already been performed to achieve the engagement objectives?

4.2.1. Organize Your Project According to Business Process Activities

There are two basic approaches to organizing your project: by financial statement account or by business process activity. A financial statement organization defines the work unit according to the financial statement account (e.g., cash, accounts receivable, accounts payable, etc.). Under that organization, one person on the team would be responsible for the controls relating to cash, a second would take on accounts receivable, and so forth. This approach is how auditors typically organize their financial statement audits.

The second approach defines the work unit according to the business process activity (e.g., cash receipts, cash disbursements, purchases, or sales). With this approach, each person on the team will take responsibility for a separate business process activity. The best way to organize an assessment of internal control is by business process activity for the simple reason that this is the ...