404(a) Management Assessment
If auditor attestation goes away, management’s ICFR responsibility doesn’t.
Many SOX programmes were shaped around the external auditor’s requirements. Without a 404(b) attestation, management needs its own defensible methodology.
The sequence
What usually has to happen
- Scoping
- Risk assessment
- Key control selection
- Testing approach
- Deficiency evaluation
- Remediation
- Annual effectiveness conclusion
- Evidence retention
- Audit committee reporting
Deliverables
What Ditton delivers
- Risk and Control Matrix extractThe backbone of the programme: each risk mapped to its assertions, the key control that addresses it, and the attributes needed to test it.
- Control design assessmentProduced after a walkthrough, to determine whether the control as designed addresses the stated risk and could prevent or detect a material misstatement.
- Testing workpaperRecords the population, sample, attributes tested, evidence examined and conclusion on a control’s operating effectiveness.
- Deficiency evaluation memoDocuments the severity assessment of a control exception, including aggregation and compensating controls, and the basis for classification.
- Programme status reportGives management a single view of programme progress, testing status, open deficiencies and risks to the timetable.
- Audit committee reporting extractSummarises ICFR status and deficiencies in the form an audit committee needs to exercise oversight.
Engagement
How to start
Fixed-fee entry point
404(a) Management Assessment Readiness Review
A review of whether the current programme gives management its own basis for the 404(a) conclusion, with written findings and a defined scope for anything larger.
Fixed fee — confirmed at scopingScoped programme
Management assessment support
Scoped from the Readiness Review’s findings: building or adapting the methodology, testing and reporting management needs to conclude on ICFR.
Scoped engagement — quoted after a scoping callDownload
Engagement Scope Note
How a Ditton engagement is scoped: deliverables, boundaries and commercial terms, agreed before work begins.