Sarbanes-Oxley Section 404 Implementation Toolkit, with CD ROM

Michael J. Ramos, CPA, is a consultant who writes extensively on emerging auditing matters. He has written numerous successful products, including non-authoritative practice aids, implementation guides and authoritative AICPA Audit and Accounting Guides. In addition to text-based products, he has also authored a variety of training programs, including computer-based multimedia training and audio and video scripts. Ramos has written in the areas of ethics, auditing, internal control and fraud detection.

• About the Author vii Preface ixAcknowledgments xiPart I Tools for Management 1ADM-1 General Work Program 3ADM-2 Project Planning Summary 17ADM-2a Checklist for Summarizing Project Team Competence and Objectivity 31ADM-2b.1 Worksheet for Determining and Documenting Significant Accounts and Disclosures 34ADM-2b.2 Mapping of Business Processes to Significant Accounts and Disclosures 40ADM-2c Example Inquiries to Identify Changes to Internal Control 45ADM-3 Senior Management Review Checklist 47ADM-4 Checklist for Preparation of Management's Report on Internal Control Effectiveness 52Part II Documentation of Internal Control Design 57DOC-1 Work Program for the Review of Documentation of Entity-Level Controls 59DOC-1a Assessment of Internal Control Effectiveness: Overall Approach to Review of the Documentation of Entity-Level Controls 62DOC-1b Assessment of Internal Control Effectiveness: Checklist for the Review of the Documentation of Entity-Level Controls 66DOC-2 Work Program for the Review of Documentation of Activity-Level Controls 80DOC-2a Assessment of Internal Control Effectiveness: Overall Approach to Review of the Documentation of Activity-Level Controls 82DOC-2b Assessment of Internal Control Effectiveness: Checklist for the Review of the Documentation of a Significant Transaction or Business Unit/Location 85DOC-3 Documentation Techniques and Selected Examples for Routine Transactions 87DOC-4 Checklist for Evaluating SOX 404 Software 110Part III Internal Control Testing Programs 113Entity-Level Controls Testing Tools 115TST-ENT-1 Summary of Observations and Conclusions about Entity-Level Control Effectiveness 119TST-ENT-1a Checklist for Small Business Entity-Level Controls 135TST-ENT-2 Work Program for Testing Entity-Level Control Effectiveness 143TST-ENT-3 Index to Tests of Entity-Level Controls: Inquiries and Surveys 171TST-ENT-3a Entity-Level Tests of Operating Effectiveness: Inquiry Note Sheets—Management 176TST-ENT-3b Entity-Level Tests of Operating Effectiveness: Inquiry Note Sheets—Board Members 187TST-ENT-3c Entity-Level Tests of Operating Effectiveness: Inquiry Note Sheets—Audit Committee Members 193TST-ENT-3d Entity-Level Tests of Operating Effectiveness: Inquiry Note Sheets—Employees 200TST-ENT-3e Example Employee Survey 207TST-ENT-4 Index to Tests of Entity-Level Controls: Inspection of Documentation 215TST-ENT-4a Worksheet to Document Inspection of Documentation of Performance of Entity-Level Controls 217TST-ENT-5 Index to Tests of Entity-Level Controls: Observation of Operations 220TST-ENT-5a Worksheet to Document Observation of Operation of Entity-Level Controls 222TST-ENT-6 Index to Tests of Entity-Level Controls: Reperformance of Controls 225TST-ENT-6a Worksheet to Document Reperformance of Entity-Level Controls 227TST-ENT-7 Work Program for Reviewing a Report on IT General Control Effectiveness 230TST-ENT-7a Planning and Review of Scope of Tests of IT General Control Effectiveness 235TST-ENT-8 Work Program for Performing an IT General Controls Review 241Guidelines for Testing Activity–Level Control Effectiveness 245TST-ACT-1 Guidelines and Example Inquiries for Performing Walkthroughs 253TST-ACT-2 Example Testing Program for Activity-Level Tests of Controls 261TST-ACT-2a Example Testing Program for Control Operating Effectiveness: Revenue 262TST-ACT-2b Example Testing Program for Control Operating Effectiveness: Purchases and Expenditures 267TST-ACT-2c Example Testing Program for Control Operating Effectiveness: Cash Receipts and Disbursements 271TST-ACT-2d Example Testing Program for Control Operating Effectiveness: Payroll 275TST-ACT-3 Work Program for the Review of a Type 2 SAS No. 70 Report 279TST-ACT-3a Type 2 SAS No. 70 Report Review Checklist 282TST-ACT-4 Process Owners’ Monitoring of Control Effectiveness 289Part IV Example Letters and Other Communications 295COM-1 Example Engagement Letter for Outside Consultants to Management 297COM-2 Example Management Representation Letter 301COM-3 Example Management Reports on Effectiveness of Internal Control over Financial Reporting 303COM-4 Example Subcertification 305Appendix A 307About the CD-ROM 385Index 389