Overview
- We reviewed 300 SOX controls and associated risks to identify controls needed to prevent or detect material misstatements.
- Reduced the number of controls needed for SOX by 40% after identifying obsolete and irrelevant risks and controls.
Behunin & Associates helped a large manufacturing client streamline its SOX risk and control matrix to improve clarity, reduce duplication, and align controls with actual risk. Our work focused on clarifying control wording, consolidating overlapping items, removing irrelevant controls, classifying controls as key or non-key and improving test procedures. This made control performance and testing more efficient and provided management and auditors with clearer documentation.
What did rationalization involve, and why does it matter?
The project involved a systematic review of 300 SOX controls and their associated risks; and was performed in conjunction with the implementation of a new ERP system which replaced two existing systems. We refined the control wording so each control plainly described the risk it mitigates and the activity it relies on. The net effect was elimination of redundant audit procedures and a clearer control descriptions.
How did the rationalization effect the organization?
The number of controls relied on for SOX financial reporting decreased by 40% and the control descriptions were clearer and more concise. The significantly lower number of controls decreased the time needed for documenting and testing controls and increased savings for:
- Control owners who perform and document controls
- Internal Audit controls testing
- External Audit control testing
Behunin & Associates refined the control framework so that our client could focus control performance, documentation and testing where it mattered most. If you want a similar rationalization, contact us to discuss a tailored approach for your control environment.