A Project Management Approach: Sustaining SOX 404
A Project Management Approach: Sustaining SOX 404
VOL.8 NO.2
Winter A Project
2007
Management
Approach
B Y S C O T T C . W I L K I N S , C PA , AND P A R V E E N P. G U P T A , P H . D .
COMPANIES CAN DEVISE A COMPLIANCE PROJECT THAT IS NOT ONLY COST EFFECTIVE
APPROACH EXAMPLE/APPLICATION
1 Identify, understand, and evaluate the design effectiveness of Tone at the top, HR policies, risk assessment process,
company-level controls. centralized processes, monitoring, and financial reporting.
2 Identify significant accounts at the financial statement or Financial statement accounts with potential for material
disclosure level. financial statement misstatement.
3 Identify assertions relevant to each significant account. Existence/Occurrence, Completeness, Valuation, Rights or
Obligations, Presentation/Disclosure.
4 Identify significant processes and major classes of transactions. The processes and classes of transactions that relate to each
significant account.
5 Identify the points at which errors or fraud could occur in the Risks to the internal control objectives.
process.
6 Identify controls to test that prevent or detect errors or fraud on a Build test plans around these controls.
timely basis.
7 Clearly link individual controls with the significant accounts and Each step in this process should build off and link to the
assertions to which they relate. previous step.
Source: PCAOB, “Staff Questions & Answers,” Auditing Internal Control Over Financial Reporting, May 16, 2005, Q38 1-4.
pliance in the future while remaining cost effective. equally exhaustively without due regard for the effec-
A top-down approach to designing a Section 404 tiveness of the company’s entity-level controls and
compliance program (and designing the actual internal underlying financial reporting risks. Inherent financial
control structure) forces senior management to start reporting risk based on the company’s unique business
with the entity-level controls that set the organization’s and reporting environment coupled with the residual
tone at the top. When designed robustly and imple- risk status of each financial statement account and note
mented properly, these entity-level controls can signifi- disclosure should determine the areas that require
cantly affect and even mitigate the need to extensively greater testing, documentation, and monitoring for both
test certain low-level transactional controls. The impact the company management and its external auditors. For
and influence of entity-level controls can be felt even example, a manual, subjective process for month-end
more in smaller public companies, where the majority revenue accruals contains considerably more inherent
of the organization is directly in the line of sight of the risk of a material financial misstatement than an auto-
senior management through its day-to-day involvement mated, routine, transaction-based process such as dis-
in operations. For medium- to large-size organizations, bursements. Similarly, an account with a history of
appropriate design and use of entity-level controls, frequent and materially large errors presents more
coupled with adequate monitoring controls, can lessen residual risk than an account with minimal history of
the amount of lower-level transactional or process past errors.
controls that are tested. Table 1 provides the PCAOB’s Approached in this manner, a top-down, risk-based
guidance on how to use the top-down approach. approach results in meaningful scoping decisions that
Though we find no clear articulation of what a “risk- promise to be efficient and effective in addressing real
based” approach entails, we believe that the essence of financial reporting risks facing the issuer’s financial
the top-down, risk-based approach to sustaining Section statements. Beyond the initial scoping decisions, this
404 compliance requires a clear understanding and approach also focuses on testing only those controls
recognition that not all individual accounts, note disclo- within a process that directly address the identified
sures, and related controls are created equal. Thus, they risks and that would lead to material misstatement in
should not be scoped in indiscriminately and tested the account balance if they failed.
Executive Sponsors
CEO/CFO
Executive Sponsors
CEO/CFO
SOX 404 compliance project work can still be relatively help ensure that proper visibility and resources are
centralized. The fact that the business is broken down attained. The more decentralized an organization is, the
into segments is usually a good indicator that there more important and difficult it is to push ownership
should be separate SOX programs for each division, down to the local operational level while still maintain-
with each program focusing on the unique nature of ing visibility and control at the executive project level.
that division and rolling up into the overall executive The creation of division-level steering committees—as
project team. It is advisable, therefore, to have unit- or well as divisional representation at the executive steer-
division-specific program steering committees that have ing committees—is a good way to accomplish this.
responsibility for the entire business unit and that The crucial decisions that determine how the overall
somewhat mirror the corporate-level SOX steering com- project is to proceed are made in the program-level
mittee. In this case, a program steering committee and steering committee meetings. Well-run steering
program lead are assigned for each major business unit committee meetings produce visibility and drive
and any functional areas that cut across all the business accountability—two very important ingredients in the
units, such as IT, HR, etc. If a particular business unit successful completion of a SOX 404 compliance project.
contains a significant or difficult area within it that has a These meetings usually include the corporate con-
different risk profile from the rest of the unit, creating a troller, members of the executive project team, internal
separate committee and project lead for that area might audit, external auditors, and the relevant members of
Project Management Office (PMO): It takes an enor- tion 404 compliance as a separate project administra-
mous amount of organizational skill and teamwork to tively to ensure that it does not get lost in daily
document, monitor, and communicate the progress of activities.
the compliance effort. In larger companies, an effective The PMO should be part of the controller’s execu-
SOX 404 compliance model involves the creation of a tive steering committee, reporting to the SOX
team of professional project managers to coordinate the director/coordinator. It includes a representative dedi-
administrative side of the project. Without successful cated to the administration of each subprogram. The
administration or project management, there is a high PMO can create value by performing the following
probability that the project could succumb to its sheer functions:
size and fail miserably. Though it is not necessary for ◆ Facilitate periodic steering committee meetings.
smaller companies to have an elaborate PMO infra- ◆ Develop, procure, and maintain the technology
structure, it is certainly important to approach the Sec- tools used for documentation and testing.