On September 24, 2009 the Public Company Accounting Oversight Board (www.pcaob.com) issued their Report on the First-Year Implementation of Auditing Standard No. 5. The report provides an overview of the most common observations derived from inspections conducted during 2008 on registered firms’ first year implementation of AS No. 5. Because AS No. 5 is a follow-up to improving the implementation of the Sarbanes-Oxley Act of 2002, the focus is on internal controls over financial reporting (ICFR).
Spreadsheet Control Cited as Area for Improvement
Notable areas of focus for inspections conducted include risk assessment, fraud related risk, and focus for controls testing. Ironically, Spreadsheet Controls were cited among the suggested areas for improvement: “The inspectors also observed situations where auditors failed to test a relevant control appropriately or, in some cases, at all. For example, inspectors observed instances where the auditors’ testing of controls over financially significant applications was dependent on appropriate segregation of duties, but the auditors did not test to determine whether appropriate segregation of duties existed. Similarly, in some instances, the auditors tested certain controls without testing the system-generated data on which the tested controls depended; the auditors did not test controls over applications that processed financially significant transactions, including important manual spreadsheets; or the auditors observed evidence of review and approval controls (e.g. management sign-off evidencing review and approval) without testing the design or operating effectiveness of management’s controls.”
What it Means to Your Business
Based on this new report, the focus on scrutinizing Spreadsheet Controls for SOX 404 and AS No. 5 compliance is likely to continue, demanding that organizations take a proactive and sustainable approach to implementing policies, procedures, best practices and new technology to help automate the process. Best practices and auditor guidance suggest that following a lifecycle approach (including inventory, risk assessment, management and control, optimization, certification and reporting) leads to efficient risk mitigation, more efficient spreadsheet processes, reduced audit fees, faster audit cycles, and improved compliance.
Eric Perry
Spreadsheet risk is a problem many organizations have but don’t realize it until it’s too late. Thanks for publishing this blog!
We are just starting to look at EUC control within our firm and this blog has been a great resource. Please keep us updated on any new developments on spreadsheets and AS5 and other new audit standards or guidance from the Big 4.