SOX 404 Compliance Checklist

SOX (Section 404) Compliance Checklist
17 Oct 2021 / PB Complete
Score 0% Failed items 0 Actions 0
Company Name
Registered Address
Prepared by PB
Conducted on 17 Oct 2021 21:24 CDT
Private & Confidential 1/3

Inspection 0%
Inspectio-n0%
Management Assessment of Internal Controls 0%

Management Assessment of Intern-a0l%Controls
Has operating management taken ownership of their processes and
documentation, rather than leaving it to the Section 404 team or the internal
auditing function?
Does operating management update all process and control documentation

promptly throughout the year and not just when testing starts?
Is there an effective change management process in place, including the timely

assessment of process changes for their potential impact on key controls?
Is operating management committed to assess and remediate all control

deficiencies promptly?
In situations where remediation is not justified based on management’s assessment

of risk and cost, is management committed to communicating that decision promptly
so the effect on management’s overall assessment of controls can be identified and
discussed with senior management?
Has a top-down, risk-based approach been used to identify the key controls?
Is management confident that all identified key controls are truly key?
Has the design of the related processes been reviewed to determine if changes can
result in fewer and more effective controls, relying more on automated controls or
on higher-level controls?
(e.g., detailed reconciliations and flux analyses)
Is management of the Section 404 program at a sufficiently high level within

the organization to influence operating management relative to completion of
their responsibilities?
Is management of the Section 404 program at a sufficiently high level within the
organization to communicate effectively with executive management the
program’s progress and potential issues?
Is management of the Section 404 program at a sufficiently high level within the
organization to negotiate as needed with the external auditor? (e.g., to increase
reliance on management testing, agree on key controls early, and address
concerns as they arise)
Is the use of internal resources optimized, including the use of internal auditors to
perform testing or to validate testing performed by management staff?
Has overall staffing been optimized, reducing reliance on more expensive external
consultants and testers?
Has reliance by the external auditor on management testing been optimized?
Does the external auditor follow a top-down, risk-based approach as required by

AS 5?
Is there a detailed project plan that includes a walk-through of all significant

processes early in the year, preferably in the first quarter?
Is there a detailed project plan with testing scheduled in such a way that all key
controls are tested by mid-year, with additional testing to update the results
scheduled closer to year-end? This enables the external auditor to start their
walkthroughs and testing early, providing time for management to address
and remediate any deficiencies identified in either management or external
auditor testing.
Is there a detailed project plan that includes all key activities required to complete
the program, such as fraud risk assessment, consideration of any end-user
computing issues, assessment of SAS 70 reports from service providers, etc.?
Is there a detailed project plan detailing all required resources, including

specialists (e.g., for IT or tax processes and controls), so they can be scheduled
early?
Is there a detailed project plan with regular reporting to senior management that
focuses on key metrics and issues?
Has there been communication and coordination with all service providers to ensure
that a SAS 70 type II report will be available at the appropriate time?
Is early warning provided for potential deficiencies being identified during the
SAS 70 audit?
Is the Section 404 program itself assessed for effectiveness on a continuing basis,
to ensure it is improved as the organization learns from experience and benefits
from changes in regulations or their interpretation?
Sign Off
Sign Off
Additional Comments

SOX 404 Compliance Checklist

Uploaded by

Copyright:

Available Formats

SOX 404 Compliance Checklist

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SOX 404 Compliance Checklist

Uploaded by

Copyright:

Available Formats

SOX (Section 404) Compliance Checklist

17 Oct 2021 / PB Complete

Score 0% Failed items 0 Actions 0

Conducted on 17 Oct 2021 21:24 CDT

Private & Confidential 1/3

Management Assessment of Internal Controls 0%

Does operating management update all process and control documentation

Is there an effective change management process in place, including the timely

Is operating management committed to assess and remediate all control

In situations where remediation is not justified based on management’s assessment

(e.g., detailed reconciliations and flux analyses)

Is management of the Section 404 program at a sufficiently high level within

Has reliance by the external auditor on management testing been optimized?

Does the external auditor follow a top-down, risk-based approach as required by

Is there a detailed project plan that includes a walk-through of all significant

Is there a detailed project plan detailing all required resources, including

You might also like