Sarbanes-Oxley Act
(Section 404) Compliance Engagements
The Comprehensive Risk Services Group of Brady Ware
Requirements
All SEC (Securities and Exchange Commission) registrants must comply with Section 404 of the Sarbanes-Oxley Act. Based on current SEC regulations, accelerated filers must be in compliance for fiscal years ending after November 15, 2004. Non-accelerated filers have until their first fiscal year ending after December 15, 2007. Section 404 requires a company to document and evaluate the effectiveness of internal controls and procedures for financial reporting. Section 404 also requires management of the registrant to assess the effectiveness of these controls and for the external auditors to attest to these assessments.
Engagement Approach Solutions
Section 404 presents a number of challenges for public companies, both initially and on an ongoing basis. You have to address risk assessment, the documentation of systems and processes and the related internal controls, evaluation of the internal control design, the development and execution of internal audit plans to test the operating effectiveness of the controls, as well as the reporting of results. The process takes expertise in accounting and auditing, internal auditing, technology, and human resources. Just as important, it also takes time. Brady Ware can help. We can be an outsourced solution to work with your in-house coordinator to drive the entire process, or we can simply assist you with the areas where you need to supplement your internal resources. If an internal solution is more appropriate for you, our staffing group can also provide contract staff or help you hire the necessary permanent employees. We understand that every company will approach Sarbanes-Oxley differently, and these individual approaches will change over time. We want to offer you the flexibility to help you through the process using whatever approach works best for you.
Key Components of Section 404 Compliance
Agreeing to a common definition and understanding of internal controls
An effective internal control evaluation must begin with a common definition of internal controls. The 1992 report from the Committee of Sponsoring Organizations of the Treadway Commission (COSO) established the most widely accepted definition of internal controls.
Establishing a steering committee and project team
The steering committee is responsible for oversight of the project team and typically includes members of upper management, the external auditors and the audit committee chairman. The project team will be responsible for organizing the resources necessary to complete the Section 404 engagement and ensuring completion of the engagement.
Documenting and evaluating entity level controls
The documentation and evaluation of the entity level controls provide an important starting point in the overall assessment process. An evaluation is done on each of the five critical internal control components of the COSO framework at the overall entity level.
Documenting and evaluating process, transaction and application level controls
A determination is made of the most significant accounts and the processes that have a major impact on these accounts. We will then assist documenting the major transactions and related processes that influence these accounts, identify where errors could occur and identify controls designed to prevent or detect those errors.
Evaluating overall effectiveness of your system of controls, identifying matters for remediation and establishing control monitoring systems
Based on the documentation and testing, an evaluation of the adequacy of the internal control structure will be made by management. Recommendations for control improvements, areas for remediation and opportunities for efficiency gains will be identified. A process for ongoing monitoring of controls will be developed. As your business changes, certain risks may become more significant and require control enhancements to respond to new markets or expanded business lines. While this Section 404 compliance is a significant undertaking, companies should also view the project as an opportunity to:
- Enhance your internal control structure
- Reduce the cost of financial processes
- Improve productivity
- Adopt controls aimed at preventing rather than detecting errors
- Improve the efficiency of financial statement preparation (by eliminating redundant controls and process inefficiencies)
- Gain a better understanding of your organization
- Build confidence in the accuracy of your financial data
For more information or assistance with your Section 404 work, contact Jim Kaiser, Susan Bridgman or Patty Ioas.