|
Indeed, assessing the readiness of the company to handle Sarbanes-Oxley, depends to the extent that the company has prior assessment of its controls.
The warehouse function involves providing a repository for all the company's documentation of internal control.
Where the documentation does not exist, then the tools should have the facility to either create new material.
The following paragraphs detail some of the requirements of control documentation and how this ties in with tools.
Remember, choosing any automated tool is not a "one-size-fits-all" or "box-ticking" exercise. Each company should draw up a list of its own requirements and base its choice on those.
In terms of the general documentation of controls the following should apply.
Control objectives all covered. At least all the significant control objectives to be documented.
Documentation is sufficient There should be enough information in the documentation so that:
Management and auditors can form an opinion on the effectiveness of design.
Management and auditors can design tests to evaluate the effectiveness of controls.
At the level of individual controls, documentation is also important.
A link between control objective and the control policy/procedure.
A description of the control policy or procedure that achieves the control objective.
Description of control policy/procedure
Descriptions of
*How the control procedure is to be applied.
*Who is responsible for the performing the procedure.
*How frequently the procedure is performed.
Information regarding:-
*Initiation, recording, processiong and reporting of transactions
*The flow of transactions to identify where material misstatements due to error or fraud could occur.
|