Obsessive Compulsive Evidence of Review Disorder
September 06, 2006
Let me be clear: our external auditors (who are reading this) are not obsessed with evidence of review. But my friend Eli, an audit manager at a great metropolitan newspaper, says hers are.
If your external auditors are like Eli's, fret not. Lack of evidence of review is not a control deficiency, since evidence of review is not a control. In order for something to qualify as a control, it has to mitigate a risk. "Evidence of review" mitigates nothing. The review is the control. Evidence of the review is only proof that the control was done. It's like a test, in a way, but it's not part a control.
And there is no statute of limitations that demands the evidence of a control be in place within a certain amount of time after the control was performed. So if your bank rec, for instance was reviewed on January 10th, the signoff for that bank rec can be done any time in the future.
Therefore, if your year end is rapidly approaching - or has even passed - and your external auditors note that you have no evidence of review, just ask your reviewer to sign off right then and there. If he actually did the review but previously did not sign it, then the control - i.e. the review - was effective at the point in time it was designed to be, but the reviewer neglected to document it. And documentation does not have to be done at the same time as the control.
If your external auditors are like Eli's, fret not. Lack of evidence of review is not a control deficiency, since evidence of review is not a control. In order for something to qualify as a control, it has to mitigate a risk. "Evidence of review" mitigates nothing. The review is the control. Evidence of the review is only proof that the control was done. It's like a test, in a way, but it's not part a control.
And there is no statute of limitations that demands the evidence of a control be in place within a certain amount of time after the control was performed. So if your bank rec, for instance was reviewed on January 10th, the signoff for that bank rec can be done any time in the future.
Therefore, if your year end is rapidly approaching - or has even passed - and your external auditors note that you have no evidence of review, just ask your reviewer to sign off right then and there. If he actually did the review but previously did not sign it, then the control - i.e. the review - was effective at the point in time it was designed to be, but the reviewer neglected to document it. And documentation does not have to be done at the same time as the control.
2 Comments:
Our company uses a "Review form" checklist rather than evidencing the review on the document. We have a list of documents that have to be reviwed, such as bank recs, reconciliaitons, payroll file, etc., and all the menegers who are responsible to review those documents sign a single row on a sheet indicating that they reviewed the dcument, with the date of review. A designated member of the compliance department is responsible to get the sheet cimpleted by the various managers. As long as the document was reviewed timely, and indicated so on the sheet, we allow it.
commented by Taconic, 5:53 AM
That works.