How to Comply With Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control

3.1. INTRODUCTION

In its interpretative guidance on evaluating internal control, the Securities and Exchange Commission (SEC) makes it clear that management's evaluation should not encompass all the controls that have been implemented at the company. The objective of management's evaluation is to provide it with a reasonable basis for determining whether any material weaknesses in internal control exist at year-end. The scope of the evaluation effort should include those controls that are necessary to meet that overall objective—no more, no less.

A great deal of judgment is required to determine which controls should be included in the evaluation process. Chapter 1 provided an overview of the risk-based, top-down approach to evaluating internal control, and it is the proper application of this approach that will allow you to make good judgments about the scope of the evaluation process.

Controls vary between entities. Moreover, the way in which individual controls combine to create an overall internal control structure also will vary. Different entities may achieve the same control objective by different controls or combinations of controls. For example, suppose that both Company A and Company B have several subsidiaries, each of which reports financial results that must be consolidated. Both companies have the same control objective: to make sure that the results reported by the subsidiaries are accurate, complete, and prepared in a way that facilitates the consolidation. They ...