How to Comply With Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control

4.4. STRUCTURING THE PROJECT TEAM

During the planning phase of the project, you should describe the overall responsibilities of the project team and how the team will be configured to achieve its objectives.

4.4.1. Establishing Responsibilities and Lines of Reporting

The project team should have the responsibility for overseeing and coordinating all of the activities relating to the evaluation of and reporting on the effectiveness of the entity's internal control. As a condition for assuming this responsibility, the team should have the authority to conduct the evaluation in a way that is appropriate given the nature, size, and complexity of the organization.

Exhibit 4.1 shows an example of how a project team for evaluating internal control fits into an entity's overall financial reporting structure. As described in Chapter 2, internal controls over financial reporting are a subset of an entity's disclosure controls and procedures. Thus, Exhibit 4.1 describes the internal control evaluation engagement team as reporting to the disclosure committee. Alternatively, the engagement team could report directly to the chief executive officer (CEO) and chief financial officer (CFO), who are responsible for certifying the effectiveness of the entity's internal control.

However the lines of reporting are configured, you should be sure that the project team reports to one of the senior committees or executives at the entity in order to emphasize that

Figure 4.1. Example Project Team Organization ...