Sarbanes-Oxley 404 Project Information (LONG)

Subject: Sarbanes-Oxley 404 Project Information (LONG)
From: "Lisa Wright" <liwright -at- earthlink -dot- net>
To: "TECHWR-L" <techwr-l -at- lists -dot- raycomm -dot- com>
Date: Wed, 10 Mar 2004 13:00:10 -0800

Hi All,
It's been quite awhile since I posted to the list. Lately I've been working
on an out-of-town gig doing Sarbanes-Oxley (SOX) 404 documentation, and I
thought some of you might be interested in what we learned during this first
go-round. This is my experience only; I'm sure that others on the list have
other experience. I'd really like to hear from anyone else involved in one
of these projects.

In publishing their 10K documents, publicly held companies are making
"financial assertions" about the numbers. What the SOX 404 documentation
does is say, these are the controls that ensure these assertions are true.
Prior to issuing the 10K, the company has one of the Big-4 auditors come in
and test the controls. The auditor then determines whether the controls are
adequate. Companies that have had to restate their finances in previous
years are more likely to be targeted by the SEC and need to have better
controls. The original deadline was for "accelerated filer" companies whose
fiscal years ended after 6/15/04. The SEC extended the deadline a couple of
weeks ago, which removed the urgency for my project but not for most.

SOX 404 is the section of the legislation that describes the documentation.
Note that it doesn't describe much of the HOW. In this way it's sort of like
ISO or CMM. The Public Company Accounting Oversight Board--PCAOB
(peek-a-boo)--is a third-party organization that is helping to define
standards for documentation. Looking at their web site (,
the final standard was just issued yesterday, so I haven't had a chance to
read it. The interesting thing about being on a project like this is that no
one has done it before. It's new. So some of it is a crap-shoot.

This is one situation where templates and consistency are critical
(inconsistency for the auditors is a red flag). I was the gatekeeper for our
quality control review process, which ultimately consisted of me, an
internal person, and another person who's read everything on the
legislation. I didn't do a lot of writing on this project; hardly any, in
fact. What I did was edit and format, and deliver bad news when I thought
things needed to be done again differently. What we really needed and did
not have was a complete set of sample documents that demonstrated writing
style, formatting, and all that for the team members to model. In addition,
later on I had another writer doing QC for format/style. I had a checklist
to give her but it made me realize that there were lots of things I was
looking and she wasn't necessarily seeing the same things.

The bigger the project, the more people you have producing these documents,
the more consistent your message and tools need to be. Everyone needs to be
operating on the same page (so to speak).

I'm currently in the process of writing up some worksheets that the writers
in the company can take to their projects and fill out for the teams. SOX
404 documentation projects will be going on for a couple of years, and then
mostly the work will be in maintaining test plans. I had one knowledgeable
person liken it to bank regulation.

The Big-4 companies (E&Y, PriceWaterhouse Cooper), etc) have pamphlets and
materials to help their clients through this process. Also, there are web
sites galore (see earlier posts). As I go through my materials, I'll post
anything else I find that's useful.

Project Info:
Writers: Accountants, finance people, auditors, in all likelihood, unless
you have a strong background in one of these areas.

Audience: Documents are written for auditors, not for the people performing
the process.

My role: Get the documents into consistent format/language. Consistency is
one of the first things the auditors will look for.

Types of documents: Process narratives, flowcharts, test plans, descriptions
of financial controls.

Tools we used: Visio, Word, Excel.

Tools we needed and did not have: A document management system. Docs right
now are stored in a Windows directory and there is no rights management or
version control. I believe version control is critical because these
documents will be living, modified for years to come, potentially.

Standards we created: File naming, control naming, QC review process
workflow, document templates, styles within templates. For flowcharts, a
background page with header/footer and a shape page showing how each shape
should be used.

Additional standards I wish I'd created: List of acceptable abbreviations,

Additional things I'd like to do: I need to read the SOX 404 material (see
earlier posts in this regard). I got this job because I'm good at other
things, not for my subject-area knowledge. And I was able to bring a lot of
value to the project. However, I'm also limited in my ability to provide
substantive help. I'll be more useful when I know more. I do have some
knowledge of accounting processes, so that helped me understand what
everyone was talking about, but it's not quite the same.

Thanks for reading this far. I hope this information is useful.



New RoboHelp X5 includes all new features such as,
content management, multi-author support, distributed
workforce support, XML and PDF support, and much more!

Purchase new Macromedia RoboHelp X5 by March 31st and receive a
$100 mail-in rebate.

You are currently subscribed to techwr-l as:
archiver -at- techwr-l -dot- com
To unsubscribe send a blank email to leave-techwr-l-obscured -at- lists -dot- raycomm -dot- com
Send administrative questions to ejray -at- raycomm -dot- com -dot- Visit for more resources and info.

Previous by Author: Re: manuscript length and timetable.
Next by Author: RE: Sarbanes-Oxley 404 Project Information (LONG)
Previous by Thread: Re: If the job posting gives you a headache, what could the job be like?
Next by Thread: RE: Sarbanes-Oxley 404 Project Information (LONG)

What this post helpful? Share it with friends and colleagues:

Sponsored Ads