Preventing Material Weakness
As the old saying goes, prevention is the best medicine. These are some best practices that can help you avoid the lingering pain of a material weakness.
- Have earlier and more frequent communication between management, the SOX provider, and the internal and external audit teams during the initial risk assessment phase.
- Complete your risk assessment earlier (ideally by the end of Q1) and share the information with the audit committee and external auditors, to get their buyoff on the findings. The Public Company Accounting Oversight Board (PCAOB) has highlighted this information sharing as a critical part of compliance efforts.
- Set up a regular biweekly or monthly status call between management, your SOX provider, and your internal and external audit teams, to make sure there are no fire drills. Everyone needs to be on the same page about what the issues are and what work is being done.
- Put your process narratives into a flowchart form. Traditional word document narratives are hard to read and increase the risk of control gaps. Flowcharts make it easier to show where risks are in a given process and help you ensure that you have mitigating controls in place, because you can see the link between risks and controls. (The PCAOB typically starts their inspection process by translating narratives into flow charts.)
- Utilize your auditor’s templates and methodologies. This synergy leads to smaller samples and reduced fees.
- Make your internal controls more precise. For example, “this account reconciliation is reviewed and approved by the CFO” is too vague. A precise control would be: “This account reconciliation is reviewed and approved by the CFO; as part of his review, he looks at all reconciling items over $1,000, ensures clerical accuracy of all calculations, and ensures that the balance for the general ledger (GL) on the face of the reconciliation ties to the GL in the system.”
- Use audit analytics/internal audit technology. This enables you to get better results in less time. For example, audit analytics allow you to do 100% control testing instead of performing sample-based testing, which is prone to manual errors.
The Bottom Line
A material weakness will increase your audit fees significantly for years after the disclosure, and the fees will typically remain higher even after remediation. The best practices outlined above will help you avoid this pain, by enabling you to better assess and mitigate your risks.
Do You Know Where Your Material Weaknesses Exist?
Maintaining strict internal controls is an essential business practice that significantly reduces risk and saves money in the long term. Contact our Internal Audit team of risk management consultants to learn the steps you can take right now to improve your internal control environment.
