Seven Cost Reduction Strategy on Testing Internal Controls
1. Perform Assessment with current and future internal controls strategy
Reperform assessment with current and future internal controls strategy is the first thing that should be done on cost reduction strategy.
2. Limiting the number of key controls
(i.e., the controls that have to be tested) by adopting a top-down, risk-based approach that focuses on controls that will prevent or detect material errors. Companies and external auditors have historically tested controls that are not key under this definition: that they are required to prevent or detect material errors. Controls that are not likely to result in material error should not be considered “key” and do not need to be within management’s scope for Section 404.
3. Using the top-down approach to identify direct entity-level controls
(e.g., month-to-month payroll variance analyses performed during the period-end close process) that provide reasonable assurance that a material misstatement due to a failure in controls within the business process (e.g., within payroll) would be detected. In this situation, it may be possible to remove any business process controls from the scope of work.
4. Maximizing reliance by the external auditor on management testing.
This requires ensuring management testing is performed by skilled, experienced individuals who are independent of the activity being tested. The latter usually have several years’ experience in a combination of external audit firms and internal auditing functions. Many companies use their internal audit function to perform the testing since this is the most likely approach to maximize external auditor reliance. Some use other internal staff to perform management testing and may rely on internal auditing to review and test their work to ensure it is to appropriate standards.x
5. Executing controls flawlessly.
The tolerance level for defects in testing is very low. If the external auditors find even one error in their testing of a control, they may assess the control as not operating effectively. This will require remediation and retesting, potentially doubling the work.
6. Documenting the processes and controls clearly and in good detail,
and then ensuring the documentation is updated promptly as processes change.
7. Completing a substantial portion of management’s work,
including testing all key controls (even if only limited in sample size) by mid-year. This enables the external auditors to start their work early, which helps with resource scheduling and reduces the risk of finding deficiencies late.
Source: SOX Section 404: A Guide for Management by Internal Controls Practitioners The IIA
Popularity: 16% [?]
