Big4Guy

Control gaps noted at the time of testing need to be remediated
before the year end. Once such control gaps are remediated, it is
important to test these remediated controls. However, testing remediated controls is a little different than normal controls testing. The remediated controls must be operating for sufficient period of time prior to the "as of" date so that the external auditor can base his opinion on them. For remediated controls also, testing would be based on the frequency of control. Below, I am listing down the testing criteria
for remediated controls based on their frequency of operation.

1. Quarterly - Should be operating effectively for atleast two quarters prior to "as of" date and the sample size required to test is 2.

2. Monthly - Should be operating effectively for atleast two quarters prior to "as of" data and sample size required is 2.

3. Weekly - Should be operational for at least 5 weeks prior to as
of date with a sample size of 2.

4. Daily - At least 20 days prior to as of date with a sample size of 10.

5. Multiple Times a Day - Sample size required is 25 and the minimum
period is 25 times over a multiple day period.

Related Posts

Evaluating Control Exceptions for SOX
Sarbanes Oxley Process Owners
Balancing Risks and Controls SOX 404
Sarbanes Oxley - Key Issues for CEO & CFO