How management and the external auditor test IT general controls and what evidence holds up: walkthroughs, design and operating effectiveness, interim testing and roll-forward, using internal audit, and documentation.
What happens in a SOX walkthrough of an IT-dependent process: following a transaction through systems and records, the probing questions auditors ask control owners, and how walkthroughs support design conclusions.
The difference between testing whether an IT general control is designed to meet its objective and whether it operated as designed, the procedures each uses, and how smaller teams with limited segregation of duties are evaluated.
How ITGCs tested mid-year are carried to the fiscal year-end assessment date: the factors that set how much roll-forward evidence is needed, when inquiry alone is enough, and the roll-forward gaps PCAOB inspections cite.
How management gathers its own evidence on ITGCs for the 404(a) assessment: direct testing, on-going monitoring and control self-assessments, how objectivity changes their weight, and when daily interaction is enough in a small company.
How far the external auditor can use internal audit's or a co-sourced team's ITGC testing: competence and objectivity tests, risk limits, inspection findings on over-reliance, and why management's evaluators should be independent of the controls.
What documentation SOX ITGCs need: management's duty to keep evidential matter, the forms SEC guidance accepts, what control descriptions should cover, and how evidence is matched to risk so testing can be reperformed.
How SOX ITGC testing changes after the first year: using prior results and change history to lower risk, benchmarking unchanged automated controls, varying tests for unpredictability, and when a new baseline is needed.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.