It sounds like it’s more of the external auditors performing a test of controls that internal audit has already performed. Is that correct?

If so then, how would an external auditor re-perform a control around revenue?

I’m trying to do a little research…..was hoping for a start….

For example, let’s say I go public today (2009), what is the first year I have to be SOX 404 compliant? Is it the the same for small or large company? Non-Accelerated or Accelerated file?

If IPO start sometime this year, will I have to be full compliant by end of this year, or since I just became public, I have till end of next year?

If possible, can you post a link for the source…..maybe an SEC ruling/site….

Thanks in advance

It’s good to find that you have such a good website discussing issues related to Section 404 of the SOX!

As far as I know, the SEC issued a Final Rule addressing the issue about Section 404 reporting by non-accelerated filers after exiting accelerated filing status. According to this Rule, whether and how an issuer must comply with Section 404 is determined on an annual basis. Therefore, an accelerated filer previously subjected to Section 404 reporting needs not to follow Section 404 if it becomes a non-accelerated filer.

Due to this Rule, the Center for Audit Quality expressed concerns that “… As a result of the relaxed provisions for exiting accelerated filer status, there are likely to be more instances in which an accelerated filer that had reported under Section 404 becomes a non-accelerated filer, particularly given the SEC’s pending proposal to further defer Section 404 reporting by non-accelerated filers …”. Based on your experience, do you see any accelerated filers that chose to “go-nonaccelerated” to avoid the Section 404 costs? Is this a real issue that the SEC should pay attention to?

Thanks for your reply!

Hung-Chao Yu
Professor of Accounting
College of Commerce (AACSB accredited)
National Chengchi University
Taipei, TAIWAN
R.O.C.

1. Gain a better understanding of the entire organization through robust documentation and not just Key Control identification. That understanding led to operational improvements as well as the intended benefits of strengthened financial reporting.
2. Involve management monitors and those who execute key controls in an ongoing process of communication with internal auditors and Senior management, not just a periodic testing exercise which they do not fully understand.
3. Gain real return on investment by demonstrating to lenders and insurers that the enhanced control environment is worthy of reductions in interest rates and premiums because it truly reduces the risk of losses and misstatements and demonstrates managements commitment to Enterprise Risk Management. My experience is in line with the study by Skaife/Collins/Kinney/Lefond mentioned above.

1. Inclusion of operational controls as Key financial controls – i.e. the control cannot be mapped to an account/assertion intersection.

2. Over-reliance on detailed, transaction level process controls when Entity Level Controls, which occur less frequently and closer the external financial reporting cycle, can often provide the required degree of precsion for identifying material misstatements.

Separately, and just as importantly, management must ensure that they don’t “over-optimize” the environment. Without the ability to link accounts/assertions/controls, manaagement may inadvertantly eliminate a control (maybe the only control) that enables them to ensure the financial statements are materially correct. Restatement of results is not acceptable!