An yearly audit of a company's financial data handling activities scrutinizes SOX compliance. Proof of all SOX internal controls for data protection and accurate financial reporting must be provided by the publicly traded firm being audited. In addition to being a legal requirement, SOX compliance is also a wise business decision.

These documents are ancillary to the Sarbanes-Oxley certificate program and are to be used as guides for conducting SOX compliance.

This section provides a few templates and information sheets that can be utilized and refined for your Sarbanes-Oxley compliance (SOX compliance). It is important to note that these tools should NOT be used as a simple SOX compliance checklist. They must be appropriately tailored to your organization. They are being provided to assist participants in brainstorming and developing the proper documentation needed for SOX compliance. They include:

1. Sarbanes-Oxley Titles – Information Sheet

   This is a summary document that outlines the important eleven titles of the Sarbanes-Oxley Act.

2. COSO Principles – Information Sheet

   This document is a summary narrative of the COSO 2013 Components and Principles.

3. ELC – Control Environment Questionnaire - Template

   This is a sample questionnaire that can be tailored to be used to assist in evaluating an organization’s control environment.

4. ELC Examples – Information Sheet

   This document provides examples of entity level controls.

5. Sarbanes-Oxley Key Terms – Information Sheet

   This document provides additional key terms that apply when complying with Sarbanes-Oxley.

6. Sarbanes-Oxley Controls Over Technology – Information Sheet

   This document is a graphic that provides information about information technology controls as they relate to Sarbanes-Oxley.

7. Risk/Control Matrix - Template

   This is a comprehensive worksheet that can be tailored to be used as a risk and control documentation matrix. It includes relevant financial statement assertions as well as aspects of information that should be documented.

8. COSO 2013 Principle Mapping - Template

   This document can be used to assist in mapping the 2013 COSO Principles to control activities.

9. SOX Accounting Risk Assessment – Information Sheet

   This document provides information for performing a top-down accounting risk assessment for SOX including a list of financial statement assertions.

10. SOX Materiality Discussion – Information Sheet

    This document provides further information for considering how to evaluate and measure a potential material weakness for SOX purposes.

11. SOX Documentation process – Information Sheet

    This document provides information on the methods to use to document processes for Sarbanes-Oxley.

12. SOX Testing process – Information Sheet

    This document provides information on the processes to use to perform SOX compliance testing for Sarbanes-Oxley.

13. Sarbanes-Oxley – Considerations for Scoping Spreadsheets – Information Sheet

    Organizations utilize spreadsheets for many purposes. It is often difficult to know whether a spreadsheet falls within the criteria for testing for Sarbanes-Oxley. This information guide provides some insight into considerations to be given when trying to determine what spreadsheets to include in testing processes.

14. COSO Control Environment Maturity Model – Template

    This is a complete template that can be used in assessing the maturity of various soft components of the control environment. Typically, this spreadsheet is utilized during a facilitated session where participants will vote on the stages of each process. However, it can be used as a brainstorming evaluation tool. In addition – some attributes listed may not be relevant to your organization. You must tailor this spreadsheet accordingly.

15. COSO Risk Assessment Questionnaire – Template

    This template can be used as a guide for evaluating the COSO components.

16. Control Environment Audit Work Program – Template

    This template provides questions that can be used or tailored when evaluating an organization’s control environment.

17. Aggregation worksheet for deficiencies – Template

    This worksheet can be used to list and link all deficiencies to financial statement assertions and then examine whether any deficiencies aggregate up to a material weakness.

18. Flowchart – Disclosure Controls and Procedures – Worksheet

    This is a general flowchart of a disclosure control and procedure process that can be used to evaluate against current organizational processes.

19. Segregation of Duties Analysis Template for Treasury Process

    Duties to consider determining the adequacy of SOD for cash receipts transactions/treasury are listed in the following chart. In smaller companies, these duties may also need to be reviewed along with other functions, as some individuals may have responsibilities in more than one area.

    To complete the matrix, first examine the responsibilities listed and tailor them to your entity. Next, list the responsible position or person in each of the columns. Then review the matrix and examine whether any responsibilities create SOD conflicts. Completion of this chart is intended to highlight potentially conflicting duties, not to be the only method of identifying all such conflicting duties.

20. Segregation of Duties Analysis Template for the Payroll Process

    The duties to be considered in determining the adequacy of SOD for payroll transactions are listed in the following chart. In smaller companies, these duties may also need to be reviewed along with those of other functions, as some individuals may have responsibilities in more than one area.

    To complete the matrix, first examine the responsibilities listed and tailor them to your entity. Next, list the responsible position or person in each of the columns. Then review the matrix and examine whether any responsibilities create SOD conflicts. Completion of this chart is intended to highlight potentially conflicting duties, not to be the only method of identifying all such conflicting duties.

21. Segregation of Duties Analysis Template for the Accounts Payable and Purchasing Process

    The duties to be considered in determining the adequacy of SOD for purchases transactions are listed in the following chart. In smaller organizations, these duties may also need to be reviewed along with those of other functions, as some individuals may have responsibilities in more than one area.

    To complete the matrix, first examine the responsibilities listed and tailor them to your entity. Next, list the responsible position or person in each of the columns. Then review the matrix and examine whether any responsibilities create SOD conflicts.

22. Segregation of Duties Analysis Template for the Revenue Process

    The duties to be considered in determining the adequacy of SOD for those responsible for sales transactions are listed in the following chart. As with other functions, in smaller companies, these duties may need to be reviewed along with those of other functions, as some individuals may have responsibilities in more than one area.

    To complete the matrix, first examine the responsibilities listed and tailor them to your entity. Next, list the responsible position or person in each of the columns. Then review the matrix and examine whether any responsibilities create SOD conflicts. Completion of this chart is intended to highlight potentially conflicting duties, not to be the only method of identifying all such conflicting duties.

23. Template for Evaluation of Financial Reporting Process considering COSO Controls

    This template can be used and tailored to evaluate a company’s financial reporting process using COSO concepts.

24. Documenting Processes Utilizing Narratives and Process Flows – Instructional

    This document provides instructional information about what to include in process narratives and flowcharts when documenting SOX processes.

25. SOX Document Process Flow

    This document is a process flow showing a project approach to SOX.

Information within this course comes from readily available public domain documents and is utilized by the trainer as a supplement for relaying the course content.

Note: The concepts outlined in this course are up to date and relevant in regards to the Sarbanes-Oxley legislation. Although there have not been any changes in the legislative concepts of the law since it’s release in 2002, some aspects of executing the work have evolved. This speaker is preparing a series of courses titled “Sarbanes-Oxley 20 years later”. Those courses can be found individually on the platform and would be beneficial for anyone involved with compliance.

NOTE: The Instructor has created 5 new segments on Sarbanes-Oxley Update - 20 Years Later:
Sarbanes-Oxley Update - 20 Years Later: Accounting Risk Assessment Considerations
Sarbanes-Oxley Update - 20 Years Later: Sourcing Emerging Risks Part 1
Sarbanes-Oxley Update - 20 Years Later: Evaluating Testing Processes
Sarbanes-Oxley Update - 20 Years Later: Sourcing Emerging Risks Part 2
Sarbanes-Oxley Update - 20 Years Later: Examining Fraud Risks