The process for assessing, classifying, aggregating and summarizing deficiencies is a vital part of the Sarbanes-Oxley Section 404 compliance process. This tool highlights questions to consider for understanding and assessing internal control over financial reporting (ICFR) deficiencies.

Sample questions to consider include: Does the organization create and distribute reports that summarize the analysis of deficiencies? Is there a process for assessing, classifying, aggregating, and summarizing deficiencies to support management’s conclusion on internal control over financial reporting?