Sarbanes-Oxley 404 Compliance Project Testing and Documentation Standards Guide

An efficient and organized testing strategy is an important part of complying with Sarbanes-Oxley (SOX) Section 404. This guide can be used by Sarbanes-Oxley project teams to test Section 404 key controls and document the testing results. It incorporates the importance of independent testing by internal audit to lessen the work required by the external auditor.

At year-end, management must assess whether there have been changes in internal controls or factors that affect the performance of internal controls that would invalidate, or otherwise impact, the test results of controls performed at an earlier point in time during the year. For example:

• The impact of changes in processes, personnel and application systems that affect the control’s environment need to be evaluated. In addition, follow-up tests or re-performance of existing tests of controls will be necessary.
• Change could affect the adequacy of control design effectiveness.
• This update should be completed prior to year-end.