Audit Methodology
How many samples are required to test for an ad hoc control?
10% of the population for the covered period
How many IPE risk a control potentially have?
5
IPE Risk 1: The data processed by the IT application from which the IPE is produced is not complete or accurate.
IPE Risk 2 (i): The data extracted from the IT application into the IPE is not the intended data or is not complete.
IPE Risk 2 (ii): The user entered parameters are inappropriate.
IPE Risk 3: The computations or categorizations performed in the creation of the IPE from the IT application are inaccurate.
IPE Risk 4: The data output from the IT application to the EUC tool is modified or lost in the transfer.
IPE Risk 5: Information added or changed (including computations and categorizations) using the EUC tool is incomplete, inaccurate or inappropriate.
How many days the documentation could be in default before actionate our PBC protocol?
1
For how long have we been using AB for SOX?
3 years
What's the name of our SOX global Sharepoint?
Aspire
How many samples we need to test for a low risk daily control across the year?
40
What IPE risk is not addressed when we find errors in formulas in an excel spreadsheet?
IPE Risk 5: Information added or changed (including computations and categorizations) using the EUC tool is incomplete, inaccurate or inappropriate.
How many levels of PBC escalation we have?
3
In what status I need to have my PBC tasks if what I received as a PBC is what I was expecting?
Certified
What is the principal PCAOB standard we use of ICFR?
2200 Auditing Internal Control Over Financial Reporting
How do auditors gather evidence?
(list the all 4 ways)
Observation
Inquiry
Inspection
Reperformance
How do you normally know you have the right data (e.g. right month, right company code)?
Inspecting the review performed by the control owner over the IPE parameters used to extract the report.
According to the deficiency protocol in how many days we need to align on the severity of a finding?
15 days (2 weeks)
Why is important to be in compliance with mandatory fields and what it is the general due date to be in compliance?
Impacts reporting. the general rule is 2 weeks before starting a new testing phase.
That Financial assertion stands by D?
Disclosure
What is the main risk (financial assertion) we try to address thru observation?
Existence
If the information is exported to excel, how do you know it is not cut off?
Reviewing the tie back procedures performed by the control owner (screenshot verifying number of lines or total amounts)
Do we need to communicate the finding before enter it in ARCHER?
Yes
How do you need to document in AB a control that you won't test in that testing phase?
Scope it out- include a test note indicating why even if that control pertains to that testing phase it won't be tested in that period
How many testing phases we have?
FOUR- WT, Interim, Rollforward and Year end -10K
Do I need to validate the population before making sample selections? Why?
Yes, we do.
We need to make sure we are sampling from a complete and accurate population. Missing this step could put at risk the testing we are performing, as the results couldn't be representative to population.
When the output of and IPE is an non-modifiable form e.g. paper or pdf, what IPE risks are not applicable?
IPE Risk 4: The data output from the IT application to the EUC tool is modified or lost in the transfer.
IPE Risk 5: Information added or changed (including computations and categorizations) using the EUC tool is incomplete, inaccurate or inappropriate.
Can I confirm a deficiency in ARCHER before communicating it to all the stakeholders?
NO, communication is key, especially when talking about findings.
Certified: the PBC was fully provided by the control owner and it is correct. It might or not need to request additional PBCs derived from this ( i.e. samples from a population).
Closed: All PBCs in regards of that task are provided and there is not need of additional PBCs.
How many samples we need to test for population of 200 records?
20
10% of the population with a minimum of 5 and a max of 25.