As your Sarbanes-Oxley project moves toward a process approach, it is important to standardize the documentation of internal controls. This presentation serves as a guide for successfully achieving that standardization. Sections in this presentation include: outlining what to document, how to do it and to what extent; understanding the documentation road map; identifying and assessing key risks; and performing walk-through procedures.
When documenting processes, risks and control activities:
- Use the Process Classification Scheme to identify key processes that materially affect priority financial reporting elements.
- Document input, activities and outputs for each subprocess. Source risks and identify key control points.
- Identify related process risks for each subprocess.
- Compare process flows to current procedures, identify gaps, and develop and update procedures, as necessary.
- Utilize a company-specific process map for each subprocess.
- Implement a process-specific risk/control matrix.