Overview
- Behunin & Associates planned and coordinated SOX testing of 100 application and IT General Controls
- The integrated team included internal audit staff and Behunin & Associates managers and staff.
Before this project began, Internal Audit did not have personnel with the skillset to audit application or IT general controls.
Behunin & Associates (B&A) served as an internal audit co-sourced SOX testing partner for a national manufacturer, handling planning, coordination, control testing and documentation, and providing management with regular updates on project status. The integrated team included company internal audit staff and B&A managers and senior auditors. Our approach combined hands-on testing and documentation of application and IT general controls and produced workpapers that could be relied on by the external audit team.
What did our co-sourcing engagement cover?
We tested 100 application and IT general controls. Our role included detailed planning, creating test procedures, execution of application control and IT general control tests, quality review, and regular progress updates to management and the internal-audit team. When needed we also provided management with guidance on how to remediate control design or operating issues.
How did we work with client staff and external auditors?
We directed and managed internal audit staff and helped them learn how to test application and IT general controls. We worked closely with company personnel responsible for the performance of internal controls. We coordinated with the external auditors during planning and execution to help improve communication and reduce duplication of efforts for company personnel and external auditors. External audit was able to rely on the control testing we performed and documented. We provided internal teams with regular status updates on the progress of the project.
What value did our work bring to the client?
- Completed testing of controls on time and with a high-level of attention to detail.
- Created workpapers documenting testing steps and conclusions, giving the client audit-ready documentation.
- Internal audit staff gained experience testing and documenting application and IT general controls.
- The external auditors were able to rely on the work performed through co-sourcing leading to further efficiencies for the Company.
- Provided practical recommendations for remediation and control improvement, so the client knew exactly what to fix and how — not just that something needed attention.