SOX Compliance Checklist

• Company Name

• Registered Address
  Address

• Prepared by

• Conducted on

  Date

Management Assessment of Internal Controls

• Has operating management taken ownership of their processes and documentation, rather than leaving it to the Section 404 team or the internal auditing function?

  Yes

  No

  N/A

• Does operating management update all process and control documentation promptly throughout the year and not just when testing starts?

  Yes

  No

  N/A

• Is there an effective change management process in place, including the timely assessment of process changes for their potential impact on key controls?

  Yes

  No

  N/A

• Is operating management committed to assess and remediate all control deficiencies promptly?

  Yes

  No

  N/A

• In situations where remediation is not justified based on management’s assessment of risk and cost, is management committed to communicating that decision promptly so the effect on management’s overall assessment of controls can be identified and discussed with senior management?

  Yes

  No

  N/A

• Has a top-down, risk-based approach been used to identify the key controls?

  Yes

  No

  N/A

• Is management confident that all identified key controls are truly key?

  Yes

  No

  N/A

• Has the design of the related processes been reviewed to determine if changes can result in fewer and more effective controls, relying more on automated controls or on higher-level controls?

  Yes

  No

  N/A

• (e.g., detailed reconciliations and flux analyses)

• Is management of the Section 404 program at a sufficiently high level within the organization to influence operating management relative to completion of their responsibilities?

  Yes

  No

  N/A

• Is management of the Section 404 program at a sufficiently high level within the organization to communicate effectively with executive management the program’s progress and potential issues?

  Yes

  No

  N/A

• Is management of the Section 404 program at a sufficiently high level within the organization to negotiate as needed with the external auditor?

  Yes

  No

  N/A

• (e.g., to increase reliance on management testing, agree on key controls early, and address concerns as they arise)

• Is the use of internal resources optimized, including the use of internal auditors to perform testing or to validate testing performed by management staff?

  Yes

  No

  N/A

• Has overall staffing been optimized, reducing reliance on more expensive external consultants and testers?

  Yes

  No

  N/A

• Has reliance by the external auditor on management testing been optimized?

  Yes

  No

  N/A

• Does the external auditor follow a top-down, risk-based approach as required by AS 5?

  Yes

  No

  N/A

• Is there a detailed project plan that includes a walk-through of all significant processes early in the year, preferably in the first quarter?

  Yes

  No

  N/A

• Is there a detailed project plan with testing scheduled in such a way that all key controls are tested by mid-year, with additional testing to update the results scheduled closer to year-end?

  Yes

  No

  N/A

• This enables the external auditor to start their walkthroughs and testing early, providing time for management to address and remediate any deficiencies identified in either management or external auditor testing.

• Is there a detailed project plan that includes all key activities required to complete the program, such as fraud risk assessment, consideration of any end-user computing issues, assessment of SAS 70 reports from service providers, etc.?

  Yes

  No

  N/A

• Is there a detailed project plan detailing all required resources, including specialists (e.g., for IT or tax processes and controls), so they can be scheduled early?

  Yes

  No

  N/A

• Is there a detailed project plan with regular reporting to senior management that focuses on key metrics and issues?

  Yes

  No

  N/A

• Including

• Progress against timetables, highlighting steps that are or may be behind schedule?

  Yes

  No

• Percentage of key controls tested compared to their scheduled completion level?

  Yes

  No

• Number and percentage of key controls that are failing?

  Yes

  No

• Number of failed controls that are potentially significant to the Section 404 assessment?

  Yes

  No

• The number of failed controls where remediation will not be completed within 30 days, so senior management can focus on a timely completion?

  Yes

  No

• The number of key controls where remediation and retesting may not be completed with sufficient time for the external auditor to retest (these are likely to be open deficiencies at year-end)?

  Yes

  No

• Costs to date and projected through the end of the year?

  Yes

  No

• Potential resource issues?

  Yes

  No

• Other issues, such as coordination and concerns raised by the external auditor?

  Yes

  No

• Has there been communication and coordination with all service providers to ensure that a SAS 70 type II report will be available at the appropriate time?

  Yes

  No

  N/A

• Is early warning provided for potential deficiencies being identified during the SAS 70 audit?

  Yes

  No

  N/A

• Is the Section 404 program itself assessed for effectiveness on a continuing basis, to ensure it is improved as the organization learns from experience and benefits from changes in regulations or their interpretation?

  Yes

  No

  N/A

Sign Off

• Additional Comments

Management Team

Member

• Name & Signature

  Sign

• Position