Overview

---
name: audit-support-overview
description: 'Sub-skill of audit-support: Overview (+3).'
version: 1.0.0
category: business
type: reference
scripts_exempt: true
---

# Overview (+3)

## Overview


SOX Section 404 requires management to assess the effectiveness of internal controls over financial reporting (ICFR). This involves:

1. **Scoping:** Identify significant accounts and relevant assertions
2. **Risk assessment:** Evaluate the risk of material misstatement for each significant account
3. **Control identification:** Document the controls that address each risk
4. **Testing:** Test the design and operating effectiveness of key controls
5. **Evaluation:** Assess whether any deficiencies exist and their severity
6. **Reporting:** Document the assessment and any material weaknesses


## Scoping Significant Accounts


An account is significant if there is more than a remote likelihood that it could contain a misstatement that is material (individually or in aggregate).

**Quantitative factors:**
- Account balance exceeds materiality threshold (typically 3-5% of a key benchmark)
- Transaction volume is high, increasing the risk of error
- Account is subject to significant estimates or judgment

**Qualitative factors:**
- Account involves complex accounting (revenue recognition, derivatives, pensions)
- Account is susceptible to fraud (cash, revenue, related-party transactions)
- Account has had prior misstatements or audit adjustments
- Account involves significant management judgment or estimates
- New account or significantly changed process


## Relevant Assertions by Account Type


| Account Type | Key Assertions |
|-------------|---------------|
| Revenue | Occurrence, Completeness, Accuracy, Cut-off |
| Accounts Receivable | Existence, Valuation (allowance), Rights |
| Inventory | Existence, Valuation, Completeness |
| Fixed Assets | Existence, Valuation, Completeness, Rights |
| Accounts Payable | Completeness, Accuracy, Existence |
| Accrued Liabilities | Completeness, Valuation, Accuracy |
| Equity | Completeness, Accuracy, Presentation |
| Financial Close/Reporting | Presentation, Accuracy, Completeness |


## Design Effectiveness vs Operating Effectiveness


**Design effectiveness:** Is the control properly designed to prevent or detect a material misstatement in the relevant assertion?
- Evaluated through walkthroughs (trace a transaction end-to-end through the process)
- Confirm the control is placed at the right point in the process
- Confirm the control addresses the identified risk
- Performed at least annually, or when processes change

**Operating effectiveness:** Did the control actually operate as designed throughout the testing period?
- Evaluated through testing (inspection, observation, re-performance, inquiry)
- Requires sufficient sample sizes to support a conclusion
- Must cover the full period of reliance