How to Comply With Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control

4.7. Appendix 4A Action Plan: Project Planning

This action plan is intended to help you implement the suggestions contained in this chapter for planning your project.

4.7.1. Information Sources

Identify and obtain sources of information about the entity that will be useful for planning purposes. For example:

• Consider published sources of information, including

  • Form 10K and other SEC filings

  • Annual report

  • Information available in the entity's investor relations section of its Web site

  • Analyst reports

• Identify key individuals to be the subject of inquiries that will help you supplement the knowledge gained through reading written materials.

4.7.2. Preliminary Understanding of Significant Control Objectives and Areas of Focus

Based on your research, develop a preliminary understanding of the entity's significant control objectives and areas of emphasis for your engagement. For example:

• Identify possible significant control objectives by considering:

  • The entity's key business activities

  • Industry characteristics

  • Significant risks facing the entity and the industry

  • Financial reporting matters

  • Significant controls defined by the relevant auditing standard

• Identify other areas of focus, including those that

  • Have a known or suspected control weakness

  • Possess a high risk for material misstatement irrespective of any controls

4.7.3. Preliminary Definition of Material Weakness

Project scope and procedures must be designed to detect material misstatements. Therefore, in planning the engagement, you ...