mapping PCAOB standard to COBIT

IT general controls

company’s management should create a certification for the certifying officers

statement

financial statements

inquire

evaluate

determine

internal controls

framework

management review for effectiveness of controls

attestation report

written conclusion

material weakness

attest

ensure

access

Maintain documentation about the internal control system and make quarterly and annual statements of the adequacy of internal controls.

Provide an annual report about the management assessment of the effectiveness of internal controls.

Ensure that the statements and reports cover all entities and relevant controls including relevant IT controls.

Enhance its knowledge of internal control and understand the organization’s overall Sarbanes-Oxley Act compliance process and how IT supports that process.

Develop a compliance plan to specifically address IT controls.

Integrate this plan into the overall Sarbanes-Oxley Act compliance plan.

understand how its systems and operational environments support financial reporting.

understand the controls required to meet the requirements of the Sarbanes-Oxley Act, and design, implement, and demonstrate them.

If IT controls already exist, they must be formalized or documented to enable compliance.

responsibilities

Attest management’s assessment of internal controls. The board of directors must form its own opinion of controls, which is subsequently attested by auditors.

Not perform certain consulting services in addition to the role of independent auditor to the same client. They can provide advice in accordance with their usual audit responsibilities.

implementing internal controls

meeting or exceeding disclosure requirements

ensuring accurate & timely reporting

Determine the project scope.

Identify the stakeholders in the project.

Identify key IT systems and subsystems to be included in the scope.

Controls over initiating, recording, processing, and reporting significant accounts and disclosures in the financial statements

Controls over the selection and application of accounting policies that conform with generally accepted accounting principles

Antifraud programs and controls

Controls on which other controls are dependent

Controls over significant nonroutine and nonsystematic transactions, such as those involving judgments and estimates

Controls over the period-end financial reporting process

Identify the IT requirements.

Assign project resources.

Form an IT control subcommittee.

Create project contact list.

Create detailed project plan.

Understand the organization’s preliminary scoping.

Communication to stakeholders

Understanding the Act’s requirements for IT

Identification of a compliance approach

Accurate scoping of the business environment

Effective communication between business and IT

project work plan

application inventory

Untitled

Determine the inherent risks to establishing the level of documentation required for compliance

Determine the extent of testing that needs to be performed to verify the effectiveness of key controls.

Understanding risks

Applications inventory with assessment of inherent risk completed

Untitled

Identify the general control objectives that support the quality and integrity of the financial information processed.

Document the policies and key controls that meet the objectives of each IT environment where compliance needs to be demonstrated.

Assess and enhance policies

develop control matrices

Technical ability in understanding the functionality of the application and related IT general control concepts

Understanding risks to financial reporting and controls is necessary to mitigate these risks

Application inventory with key controls identified

Untitled

Document the organization’s policy for addressing each control objective.

Obtain an understanding of how the control objectives are met within the IT environments.

Document the control design at the entity level and the activity level to show how the control objectives are met.

Management should discuss the extent and detail of control documentation with independent accountants to minimize risks.

Ensuring documentation is at an appropriate level

Avoiding too much, too little, or no documentation

Documented controls in a format agreed between the Sarbanes-Oxley team and the external auditor

Untitled

How each significant transaction is initiated, authorized, recorded, processed, and reported

Sufficient information about the flow of transactions to identify the points at which material misstatements due to error or fraud could occur

Controls designed to prevent or detect fraud, including who performs the controls and related segregation of duties

Controls over safeguarding of assets

Results of management’s testing and evaluation

Understand controls that support the achievement of Sarbanes-Oxley Act compliance

Evaluate the design considering control attributes and whether the approach addresses risks effectively

If appropriate, enhance the design to provide for an effective approach

Review the list of controls identified in documenting the control design

Evaluate the effectiveness and reliability of the control design, especially key controls.

Investigate weaknesses and enhance the design or operation of controls to improve effectiveness.

Update the control matrix with the results of the design evaluation.

Suitability and availability of existing documentation

Understanding of process by person interviewed

Good understanding and communication of the Sarbanes-Oxley Act, COSO, and COBIT concepts by both business and IT

Good communication and facilitation between Sarbanes-Oxley Act IT team and the rest of the organization

Good research on closing the gap by IT specialists

Common rules and understanding of how to deal with similar situations across different IT facilities

preliminary completion of the application inventory up to the gap analysis

updated inventory and identified key controls

Untitled

confirm operational effectiveness of the controls as designed

Determine the controls to be tested; testing depends on their significance to financial reporting.

Test the effectiveness of control activities for key controls.

Test third-party service providers within the scope of compliance.

Identify weaknesses (compliance gaps).

Good understanding of the Sarbanes-Oxley Act, COSO, and COBIT concepts by business and IT

Good communication and facilitation between Sarbanes-Oxley Act IT team and the rest of the organization

Good research on closing the gap by IT specialists

Common rules for dealing with similar situations across different IT facilities

Preparation of an efficient testing plan

Agreement on sampling sizes and attribute being tested

Record keeping of normal testing; leveraging of existing test results from normal IT implementation activities

Completed test plans

Updated applications inventory summarizing testing and results of testing

Updated gap list including dates for closing gaps

Dates for retesting failed tests

Reassessment of significant gaps in gap list, showing whether a gap could be a deficiency, significant deficiency, or material weakness

Summary of testing results for the Sarbanes-Oxley project manager

Untitled

Identify the remediation action.

Create the implementation plan.

Assess deficiencies.

Categorize deficiencies as material weaknesses or significant deficiencies.

Identify compensating controls and preventive controls.

Management demonstration of commitments to closing gaps

Most effective method of closing a gap for section 404 reporting

Efficient gap solutions for the future

Setting realistic remediation dates

Proposed solution’s acceptability to management and the external auditor

Communication with the external auditor, business process teams, and Sarbanes-Oxley project manager

Updated application inventory

Updated gap list

Dates for retesting

Summary of gaps, deficiencies and material weaknesses, and solutions for Sarbanes-Oxley project manager

Untitled

identify improvements required for gaps between IT & business

Document the results of tests performed.

Produce a management report of control effectiveness.

Provide a record of the process followed, decisions reached, and conclusions drawn to facilitate management’s certification of control.

Document and record the results of tests performed.

Use the test results as a basis for management assertion and auditor attestation.

Provide a comprehensive summary of control effectiveness that includes all testing activities.

Include material weaknesses and proposed corrective actions and dates to implement.

Assess potential impact on application controls and other controls to reduce risk such as monitoring controls and application controls.

Effective communication

Identification of gap solutions and remediation dates

Management summary

Management report

Documentation of test results

Untitled

Perform a postimplementation review of the Sarbanes project.

Review recent PCAOB and SEC speeches and guidance.

Review other independent material.

Meet peers in other organizations to discuss process improvements.

Assess long-term solutions to address Sarbanes-Oxley issues.

Develop a plan and timetable for the following year.

Plan wider IT governance initiatives.

Communication with all stakeholders

Commitment to improvement

Ongoing commitment of executive and senior management

Postimplementation review report

Assessment of longer term solutions to address Sarbanes-Oxley issues such as automation of process and implementation of program change controls software

Development of a preliminary plan and timetable for the following year

all stakeholders

make internal control and compliance business as usual

statement of control

Description of processes or subprocesses and related risks

Statement of the control objective to reduce the risk to an acceptable level

Description of control activities

Description of the approach followed to confirm the existence and effectiveness of control activities

Conclusions about the effectiveness of controls

Data center operation controls such as job setup and scheduling, operator actions, and data backup and recovery procedures

System software controls such as effective acquisition, implementation and maintenance of system software, and database management

Access security controls that prevent inappropriate and unauthorized use of the system

Application system development and maintenance controls over development methodology, including system design and implementation

characteristics

ensure the completeness, accuracy, authorization, and validity of transactions

Current

Appropriate

Accurate

Accessible

Timely

Development and communication of corporate policies

Development and communication of reporting requirements, including deadlines, reconciliations, and the format and content of monthly, quarterly, and annual management reports

Consolidation and communication of financial information

Development and communication of standards to achieve corporate policy objectives

Identification and timely communication of information to assist in achieving business objectives

Identification and timely reporting of security violations

Centralized continuous monitoring of computer operations

Centralized monitoring of security

IT internal audit reviews

Defect identification and management

Local monitoring of computer operations or security

Supervision of local IT personnel

IT governance process

monitoring

reporting

PO10.1 Programme management framework

PO10.2 Project Management Framework

PO10.3 Project Management Approach

PO10.4 Stakeholder Commitment

PO10.5 Project Scope Statement

PO10.6 Project Phase Initiation

PO10.7 Integrated Project Plan

PO10.8 Project resources

PO10.9 Project Risk Management

PO10.10 Project quality plan

PO10.11 Project change control

PO10.12 Project planning of assurance methods

PO10.13 Project performance management, reporting and monitoring

PO10.14 Project closure

IT KGI

process KGI

KPI

DS2.1 Definition of all supplier relationships

DS2.2 Supplier relationship management

DS2.3 Supplier risk management

IT KGI

process KGI

KPI

process owner

repeatability

goals & objective

roles & responsibility

process performance

policy, plans & procedures

The defined control objective directly impacts the information criterion.

The defined control objective satisfies only to a lesser extent or indirectly the information criterion concerned.

This could be applicable; however, requirements are more appropriately satisfied by another criterion in this process and/or by another process.