How to Comply With Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control

2.4. INTERNAL CONTROL FOR SMALL BUSINESSES

In 2006, COSO issued a new document, Internal Control over Financial Reporting—Guidance for Smaller Public Companies. As the title suggests, the report provides insight on how smaller companies can apply the COSO internal control framework.

This report was issued in response to concerns raised by small businesses that many of the requirements of Section 404 of Sarbanes-Oxley were impractical for them and cost-prohibitive to implement. The COSO Report begins by describing the characteristics of a "small business" as including one or more of these characteristics:

• Fewer lines of business and fewer products with lines

• Concentration of marketing focus, by channel or geography

• Leadership by management with significant ownership interest or rights

• Fewer levels of management, with wider spans of control

• Less complex transaction processing systems and protocols

• Fewer personnel, many having a wider range of duties

• Limited ability to maintain adequate staffing in both operating and support positions, such as legal, human resources, accounting and internal auditing

Given these characteristics of small businesses, it is common that they face certain challenges to implementing internal control. These challenges typically include.

• Obtaining sufficient resources to achieve adequate segregation of duties.

• Management's ability to dominate activities. This increases opportunities for improper management override of processes in order to appear that financial ...