Internal Controls

ScreenSarbanes-Oxley (SOX)·step 1

Complete the Identity fields. Each value is validated against the schema before the next step unlocks.

• Domain entity ID (required)

  entityId

  The organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.

• Control (required)

  controlId

  Enter control.

• Control owner (required)

  controlOwner

  Enter control owner.

• Process area (required)

  processArea

  Enter process area.

ScreenSarbanes-Oxley (SOX)·step 2

Complete the Hierarchy fields. Each value is validated against the schema before the next step unlocks.

• Level in the hierarchy (required)

  controlLevel

  Enter level in the hierarchy.

• Parent controloptional

  parentControlId

  Absent only at the financial-statement level. A control with no parent below the root is unreachable from the risk it addresses.

• COSO component (required)

  cosoComponent

  Enter coso component.

• Entity-level controls this relies uponoptional

  relianceOnEntityLevelControlIds

  Enter entity-level controls this relies upon.

• An entity-level control above this one is ineffectiveoptional

  entityLevelControlIsIneffective

  Enter an entity-level control above this one is ineffective.

• Why the pervasive weakness does not affect this controloptional

  pervasiveWeaknessReasoning

  Explicit and recorded. Silence here is not an argument.

ScreenSarbanes-Oxley (SOX)·step 3

Complete the Design fields. Each value is validated against the schema before the next step unlocks.

• Type (required)

  controlType

  Enter type.

• Frequency (required)

  controlFrequency

  Enter frequency.

• Automation (required)

  controlAutomation

  Enter automation.

• Key status (required)

  keyStatus

  Enter key status.

• Key status rationaleoptional

  keyStatusRationale

  Required for non-key. De-scoping by reclassification is invisible unless the judgement is written down.

ScreenSarbanes-Oxley (SOX)·step 4

Complete the IT Dependency fields. Each value is validated against the schema before the next step unlocks.

• Report or system output relied uponoptional

  reliedUponReportId

  Enter report or system output relied upon.

• ITGCs over the producing systemoptional

  producingSystemItgcIds

  Where these are ineffective the dependent manual control cannot be relied upon, however well the review itself was performed.

ScreenSarbanes-Oxley (SOX)·step 5

Complete the Design Period fields. Each value is validated against the schema before the next step unlocks.

• Design version (required)

  designVersionId

  Enter design version.

• Design effective from (required)

  designEffectiveFrom

  Enter design effective from.

• Design effective tooptional

  designEffectiveTo

  A design change mid-period splits the testing obligation. Leaving this open means the design is current.

ScreenSarbanes-Oxley (SOX)·step 6

Complete the Assertions fields. Each value is validated against the schema before the next step unlocks.

• Assertions addressed (required)

  assertionsAddressed

  The financial statement assertions this control supports. At least one — a control addressing no assertion is not reachable from any risk.

• Significant accountoptional

  significantAccount

  The account whose assertions these are. Optional for entity-level controls, which address assertions pervasively.

• Coverage stateoptional

  coverageState

  Derived, not asserted. An assertion covered only by non-key controls is not covered for reliance purposes.

ScreenSarbanes-Oxley (SOX)·step 7

No manual input is captured here: this step is completed from the preceding sections or by the platform.

No manual inputs in this step.