Long gone are the days when a signature and date on an account reconciliation was sufficient to satisfy the documentation and evidence requirements of a SOX audit. When it comes to evidencing SOX controls, particularly management review controls, public companies are being asked to do more- document more; retain more; and perform more. The ever-increasing expectations are reflective of the trickle-down effect of recent PCAOB Firm Inspection Reports, which have indicated that external audit firms are not sufficiently executing their integrated audits and companies are not effectively designing and executing their management review controls.
Within this CFGInsight publication, we will be addressing how public companies can efficiently and effectively execute management review controls, with a specific focus on account reconciliations.
ASSESSING YOUR MANAGEMENT REVIEW CONTROLS
Management should regularly assess the design and effectiveness of controls. The following checklist can be utilized to identify potential design issues associated with management review controls:
EXAMPLE OF A POORLY-DESIGNED MANAGEMENT REVIEW CONTROL
It is not uncommon to find the following control in a company’s control matrix: The Accounts Receivable account reconciliation is reviewed.
Using the checklist above, let’s assess this control description’s shortcomings:
A PRACTICAL EXAMPLE – ACCOUNT RECONCILIATIONS
Account reconciliations are arguably the most important management review control. Investing time upfront on the design of each significant account reconciliation will pay dividends in the end.
So where does management begin?
We recommend that for each balance sheet account – prioritizing the most material and significant accounts first – management create an account reconciliation coversheet (see Exhibit 1). Establishing working groups consisting of individuals with varying levels of skills, roles and experience to create the coversheets often works well. Further, soliciting input from your internal and external auditors is also recommended.
Exhibit 1 – Accounts Receivable Reconciliation Coversheet:
Management review controls are under increased scrutiny by the PCAOB and external audit firms. Companies have a vested interest in improving the precision in which their management review controls are designed and executed. Prioritizing account reconciliation design and execution procedures often seems to work well given their importance to a company’s overall system of internal control; however, management should also consider enhancing other management review controls, including controls over the review of accounting memos, budgets-to-actuals, Business Performance Reviews and other critical meetings.
Enhancing the design and precision of controls will not only lead to a more efficient audit, but will also provide management with additional assurance that all significant and relevant risks are being appropriately addressed. Further, we have found that establishing detailed review procedures is a game changer for companies undergoing significant turnover, transformation or growth, as it reduces the risk that critical review procedures are missed or inconsistently applied due to the transition of roles and responsibilities. CFGI has extensive experience designing management review controls that meet the ever-increasing needs and requirements of the company, its stakeholders, regulators, and auditors.