Complying with Sarbanes-Oxley Section 404: A Guide for Small Publicly Held Companies

Preface.

Acknowledgments.

About the Author.

1  Introduction and Company Requirements.

Chapter Summary.

Lessons Learned.

Management's Evaluation of Internal Control.

SEC Company Requirements.

Working with the Independent Auditors.

2  The COSO Internal Control Framework.

Chapter Summary.

Need for Control Criteria.

The Triangle of Efficiency.

COSO Internal Control Integrated Framework.

Information and Communication.

Internal Control for Small Businesses.

Information Technology Controls.

Control Objectives and Assertions – The Building Blocks of Controls. Documentation.

Example Control Objectives by COSO Component.

Assertions Adopted by the AICPA.

Appendix 2A Understanding and Awareness of Control Responsibilities.

Appendix 2B Management Antifraud Programs and Controls: An Element of the Control Environment.

Appendix 2C Blue Ribbon Committee on Improving the Effectiveness of Corporate Audit Committees.

3 Project Scoping.

Chapter Summary.

Introduction.

Does “In Scope” Imply Extensive Testing?

Review Obvious Information Sources

Appendix 3A Summary of Scoping Inquiries.

Appendix 3B Understanding Fraud Risk Assessment.

4 Project Planning.

Chapter Summary.

Objective of Planning.

Information Gathering for Decision Making.

Structuring the Project Team.

Consider Project Tools and Software.

Consider a Pilot Project.

Coordinating with the Independent Auditors.

Documenting Your Planning Decisions.

5 Documentation of Internal Controls.

Chapter Summary.

Importance of Documentation.

Assessing the Adequacy of Existing Documentation.

Documentation Supporting the Control Environment.

Documenting Activity-Level Controls.

Finding Control Activity Control Objectives.

Appendix 5A Sample Control Objectives for Major Control Activities.

Appendix 5B Linkage of Significant Control Objectives to Example. Control Policies and Procedures.

6 Testing and Evaluating Entity-Level Controls.

Chapter Summary.

Overall Objective of Testing Entity-Level Controls.

Testing Techniques and Evidence.

Evaluating the Effectiveness of Entity-Level Controls.

Documenting Test Results.

Appendix 6A Conducting Interviews – Gathering Internal Control Information.

Appendix 6B Example Practice Aids

Appendix 6C Example Inquiries of Management Regarding Entity-Level Controls.

7 Testing and Evaluating Activity-Level Controls.

Chapter Summary.

Introduction.

Confirm Your Understanding of the Design of Controls First.

Assessing the Effectiveness of Design.

Assessing Operating Effectiveness.

Evaluating Test Results.

Documentation of Test Procedures and Results.

Interactions with the Independent Auditors.

Appendix 7A Sample Size Tutorial.

Appendix 7B Example Inquiries.

8 Evaluating Control Deficiencies and Reporting on Internal Control Effectiveness.

Chapter Summary.

Control Deficiencies.

Evaluating Control Deficiencies.

Annual and Quarterly Reporting Requirements.

Expanded Reporting on Management's Responsibilities for Internal Control.

Coordinating with the Independent Auditors and Legal Counsel.

Appendix 8A Action Plan: Reporting.

Appendix 8B Assessing the Potential Magnitude of a Control Deficiency.

Key Resources.

Final Rule: Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports.

Index.