SEC Votes to Improve SOX Implementation
December 14, 2006
Here's what they said, short version:
1) Materiality threshold for misstatement is higher: The definition of Material Weakness was changed to from a "more than remote possibility" that a material misstatement in the financial statements would not be prevented or detected in a timely manner, to a "reasonable possibility" that a material misstatement in the financial statements would not be prevented or detected in a timely manner. I assume a "reasonable possibility" is greater than a "more than remote possibility".
2) Risk evaluation more customized: Management is allowed to direct their efforts towards those areas that pose greatest risk to reliable financial reporting based on the company's unique facts and circumstances. Support for this evaluation can be done in a variety of ways that involve its existing daily interaction with its business, self-assessment, and other ongoing monitoring activities.
3) Documentation requirements are eased (a bit): Documentation of contols and testing can take many forms, can be presented in a number of ways, and does not need to include all controls within a process that impacts financial reporting. Sometimes you can rely on your daily interaction with your controls as a basis for your assessment with no adidtional transaction testing. In such a case, you may have limited documentation created specifically for the testing beyond documentation regarding how its interaction provided you with your comfort that the controls are effective.
For the long version, click here.
1) Materiality threshold for misstatement is higher: The definition of Material Weakness was changed to from a "more than remote possibility" that a material misstatement in the financial statements would not be prevented or detected in a timely manner, to a "reasonable possibility" that a material misstatement in the financial statements would not be prevented or detected in a timely manner. I assume a "reasonable possibility" is greater than a "more than remote possibility".
2) Risk evaluation more customized: Management is allowed to direct their efforts towards those areas that pose greatest risk to reliable financial reporting based on the company's unique facts and circumstances. Support for this evaluation can be done in a variety of ways that involve its existing daily interaction with its business, self-assessment, and other ongoing monitoring activities.
3) Documentation requirements are eased (a bit): Documentation of contols and testing can take many forms, can be presented in a number of ways, and does not need to include all controls within a process that impacts financial reporting. Sometimes you can rely on your daily interaction with your controls as a basis for your assessment with no adidtional transaction testing. In such a case, you may have limited documentation created specifically for the testing beyond documentation regarding how its interaction provided you with your comfort that the controls are effective.
For the long version, click here.