• E-mail
• Print
• RSS

Tip: Six steps to conducting a SOX 404 audit

Healthcare Auditing Weekly, July 15, 2008

1. Identify significant accounts – start with financial statements and identify material accounts related to the cycle under review.
2. Identify the high-level business processes that are relevant for the cycle (e.g., for expenditures: purchasing, receiving, invoicing, etc.). Then define the sub-processes that fall under each process.
3. For each process, identify the control objectives and relevant financial statement assertions (e.g., all purchase orders are approved).
4. Meet with subject matter experts to document process flows and controls. Perform a walkthrough to validate your understanding of the processes and ensure controls are in place.
5. Identify control activities that meet the control objectives (e.g. the control used to ensure purchase orders are approved). Identify which of these controls are key controls – those that reduce the risk associated with a given process to an acceptable level.
6. Management provides its assertion about the adequacy of the controls through the testing of identified control activities. The external auditor performs an attestation on the controls and provides an opinion on management’s assessment process.

This tip is adapted from The Healthcare Auditor’s Handbook. For more information about the book or to order your copy, visit the HCMarketplace.

• Comment
• E-mail to a Colleague
• Print
• RSS
• Archive

Comments