Introduction and Definition:
As per the provisions of section 404 of Sarbanes-Oxley Act of 2002 ("SOX"), all public companies are required to comply with timelines pertaining to management reporting on internal controls on financial reporting. The internal control report must be made part of the filings to the SEC. For the purpose of SOX, internal control is broadly defined as a process, affected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: * effectiveness and efficiency of operations * reliability of financial reporting * compliance with applicable laws and regulations
The section also requires companies to check the effectiveness of internal controls and procedures for financial reporting and in doing so the companies must: * Document existing controls and procedures that relate to financial reporting * Test their effectiveness * Report on any gaps or poorly documented areas
CSCO Framework:
For the purpose of SOX 404 controls most organizations have selected the CSCO framework, which describes internal controls as consisting of five interrelated components. These are generally called “layers,” and the controls within each must be included in management’s assessment. The five layers are described by COSO as: * Control Environment activities include the organization’s code of conduct (an entity-level control) as well as employee candidate background checks (performed at the activity level). * Risk Assessment includes assessing the risk of an unassertive audit committee (entity-level) or the existence of excess inventory. * Control Activities include top-level reviews performed as part of the corporate close process (entity-level) as well as bank reconciliations (activity level). * Information