In financial auditing of public companies in the United States, SOX 404 top–down risk assessment (TDRA) is a financial risk assessment performed to comply with Section 404 of the Sarbanes-Oxley Act of 2002 (SOX 404). Under SOX 404, management must test its internal controls; a TDRA is used to determine the scope of such testing. It is also used by the external auditor to issue a formal opinion on the company's internal controls. However, as a result of the passage of Auditing Standard No. 5, which the SEC has since approved, external auditors are no longer required to provide an opinion on management's assessment of its own internal controls.
Detailed guidance about performing the TDRA is included with PCAOB Auditing Standard No. 5 (Release 2007-005 "An audit of internal control over financial reporting that is integrated with an audit of financial statements")PCAOB Auditing Standard No. 5 and the SEC's interpretive guidance (Release 33-8810/34-55929) "Management's Report on Internal Control Over Financial Reporting".SEC Interpretive GuidanceSEC List of SOX Guidance This guidance is applicable for 2007 assessments for companies with 12/31 fiscal year-ends. The PCAOB release superseded the existing PCAOB Auditing Standard No. 2, while the SEC guidance is the first detailed guidance for management specifically. PCAOB reorganized the auditing standards as of December 31, 2017, with the relevant SOX guidance now included under AS2201: An Audit of Internal Control Over Financial Reporting That is Integrated with An Audit of Financial Statements.PCAOB AS2201 An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial Statements-December 31, 2017
The language used by the SEC chairman in announcing the new guidance was very direct: "Congress never intended that the 404 process should become inflexible, burdensome, and wasteful. The objective of Section 404 is to provide meaningful disclosure to investors about the effectiveness of a company's internal controls systems, without creating unnecessary compliance burdens or wasting shareholder resources."SEC Press Release 2007-101 Based on the 2007 guidance, SEC and PCAOB directed a significant reduction in costs associated with SOX 404 compliance, by focusing efforts on higher-risk areas and reducing efforts in lower-risk areas.
TDRA is a hierarchical framework that involves applying specific risk factors to determine the scope and evidence required in the assessment of internal control. Both the PCAOB and SEC guidance contain similar frameworks. At each step, qualitative or quantitative risk factors are used to focus the scope of the SOX404 assessment effort and determine the evidence required. Key steps include: identifying significant financial reporting elements (accounts or disclosures) identifying material financial statement risks within these accounts or disclosures determining which entity-level controls would address these risks with sufficient precision determining which transaction-level controls would address these risks in the absence of precise entity-level controls determining the nature, extent, and timing of evidence gathered to complete the assessment of in-scope controls
Management is required to document how it has interpreted and applied its TDRA to arrive at the scope of controls tested. In addition, the sufficiency of evidence required (i.e., the timing, nature, and extent of control testing) is based upon management (and the auditor's) TDRA. As such, TDRA has significant compliance cost implications for SOX404.
Method
The guidance is principles-based, providing significant flexibility in the TDRA approach. There are two major steps: 1) Determining the scope of controls to include in testing; and 2) Determining the nature, timing and extent of testing procedures to perform.
Determining scope The key SEC principle related to establishing the scope of controls for testing may be stated as follows: "Focus on controls that adequately address the risk of material misstatement." This involves the following steps:
Determine significance and misstatement risk for financial reporting elements (accounts and disclosures)
Under the PCAOB AS 5 guidance, the auditor is required to determine whether an account is "significant" or not (i.e., yes or no), based on a series of risk factors related to the likelihood of financial statement error and magnitude (dollar value) of the account. Significant accounts and disclosures are in-scope for assessment, so management typically includes this information in its documentation and generally performs this analysis for review by the auditor. This documentation may be referred to in practice as the "significant account analysis." Accounts with large balances are generally presumed to be significant (i.e., in-scope) and require some type of testing.
New under the SEC guidance is the concept of also rating each significant account for "misstatement risk" (low, medium, or high), based on similar factors used to determine significance. The misstatement risk ranking is a key factor used to determine the nature, timing, and extent of evidence to be obtained. As risk increases, the expected sufficiency of testing evidence accumulated for controls related to significant accounts increases (see section below regarding testing & evidence decisions).
Both significance and misstatement risk are inherent risk concepts, meaning that conclusions regarding which accounts are in-scope are determined before considering the effectiveness of controls.
Identify financial reporting objectives Objectives help set the context and boundaries in which risk assessment occurs. The COSO Internal Control-Integrated Framework, a standard of internal control widely used for SOX compliance, states: "A precondition to risk assessment is the establishment of objectives..." and "Risk assessment is the identification and analysis of relevant risks to achievement of the objectives." The SOX guidance states several hierarchical levels at which risk assessment may occur, such as entity, account, assertion, process, and transaction class. Objectives, risks, and controls may be analyzed at each of these levels. The concept of a top-down risk assessment means considering the higher-levels of the framework first, to filter from consideration as much of the lower-level assessment activity as possible.
There are many approaches to top-down risk assessment. Management may explicitly document control objectives, or use texts and other references to ensure their risk statement and control statement documentation is complete. There are two primary levels at which objectives (and also controls) are defined: entity-level and assertion level.
An example of an entity-level control objective is: "Employees are aware of the Company's Code of Conduct." The COSO 1992–1994 Framework defines each of the five components of internal control (i.e., Control Environment, Risk Assessment, Information & Communication, Monitoring, and Control Activities). Evaluation suggestions are included at the end of key COSO chapters and in the "Evaluation Tools" volume; these can be modified into objective statements.
An example of an assertion-level control objective is "Revenue is recognized only upon the satisfaction of a performance obligation." Lists of assertion-level control objectives are available in most financial auditing textbooks. Excellent examples are also available in AICPA Statement on Auditing Standards No. 110 (SAS 110) AICPA Statement on Auditing Standards No. 110 for the inventory process. SAS 106 includes the latest guidance on financial statement assertions.AICPA Statement on Auditing Standards No. 106
Control objectives may be organized within processes, to help organize the documentation, ownership and TDRA approach. Typical financial processes include expense & accounts payable (purchase to payment), payroll, revenue and accounts receivable (order to cash collection), capital assets, etc. This is how most auditing textbooks organize control objectives. Processes can also be risk-ranked.
COSO issued revised guidance in 2013 effective for companies with year-end dates after December 15, 2014. This essentially requires control statements to be referenced to 17 "principles" beneath the five COSO "components." There are approximately 80 "points of focus" that can be evaluated specifically against the controls of the company, to form a conclusion about the 17 principles (i.e., each principle has several relevant points of focus). Most of the principles and points of focus relate to entity-level controls. As of June 2013 the approaches used in practice were in the early stages of development.COSO-J. Stephen McNally-The 2013 COSO Framework & SOX Compliance One approach would be to add the principles and points of focus as criteria within a database and reference each to the relevant controls that address them.
Identify material risks to the achievement of the objectives One definition of risk is anything that can interfere with the achievement of an objective. A risk statement is an expression of "what can go wrong." Under the 2007 guidance (i.e., SEC interpretive guidance and PCAOB AS5), those risks that inherently have a "reasonably possible" likelihood of causing a material error in the account balance or disclosure are the material misstatement risks ("MMR"). Note that this is a slight amendment to the "more than remote" likelihood language of PCAOB AS2, intended to limit the scope to fewer, more critical material risks and related controls.
An example of a risk statement corresponding to the above assertion level control objective might be: "The risk that revenue is recognized before the delivery of products and services." Note that this reads very similarly to the control objective, only stated in the negative.
Management develops a listing of MMR, linked to the specific accounts and/or control objectives developed above. MMR may be identified by asking the question: "What can go wrong related to the account, assertion or objective?" MMR may arise within the accounting function (e.g., regarding estimates, judgments, and policy decisions) or the internal and external environment (e.g., corporate departments that feed the accounting department information, economic and stock market variables, etc.) Communication interfaces, changes (people, process or systems), fraud vulnerability, management override of controls, incentive structure, complex transactions, and degree of judgment or human intervention involved in processing are other high-risk topics.
In general, management considers questions such as: What is really difficult to get right? What accounting problems have we had in the past? What has changed? Who might be capable or motivated to commit fraud or fraudulent financial reporting? As a high percentage of financial frauds historically have involved the overstatement of revenue, such accounts typically merit additional attention. AICPA Statement on Auditing Standards No. 109 (SAS 109) also provides helpful guidance regarding financial risk assessment.
Under the 2007 guidance, companies are required to perform a fraud risk assessment and assess related controls. This typically involves identifying scenarios in which theft or loss could occur and determining if existing control procedures effectively manage the risk to an acceptable level.PWC – Elements of an Anti-Fraud Program The risk that senior management might override important financial controls to manipulate financial reporting is also a key area of focus in the fraud risk assessment.AICPA Management Override
In practice, many companies combine the objective and risk statements when describing MMR. These MMR statements serve as a target, focusing efforts to identify mitigating controls.
Identify controls that address the material misstatement risks (MMR)