page_title: SOX 404 top–down risk assessment
section_title: Considerations in testing and evidence decisions
hierarchical_section_title: SOX 404 top–down risk assessment / Considerations in testing and evidence decisions
caption_attribution_description: English: SEC Risk Graphic References Source is the 2007 SEC guidance, page 24.[1] I've added some captions to further clarify. ↑ SEC Interpretive Guidance
context_page_description: In financial auditing of public companies in the United States, SOX 404 top–down risk assessment is a financial risk assessment performed to comply with Section 404 of the Sarbanes-Oxley Act of 2002. The term is used by the U.S. Public Company Accounting Oversight Board and the Securities and Exchange Commission. The TDRA is used to determine the scope and required evidence to support management's testing of its internal controls under SOX404. It is also used by the external auditor to issue a formal opinion on the company's internal controls. However, as a result of the passage of Auditing Standard No. 5, which the SEC has since approved, external auditors are no longer required to provide an opinion on management's assessment of its own internal controls.
  Detailed guidance about performing the TDRA is included with PCAOB Auditing Standard No. 5 and the SEC's interpretive guidance "Management's Report on Internal Control Over Financial Reporting". This guidance is applicable for 2007 assessments for companies with 12/31 fiscal year-ends.
context_section_description: The key SEC principle regarding evidence decisions can be summarized as follows: "Align the nature, timing and extent of evaluation procedures on those areas that pose the greatest risks to reliable financial reporting." The SEC has indicated that the sufficiency of evidence required to support the assessment of specific MMR should be based on two factors: a) Financial Element Misstatement Risk ("Misstatement Risk") and b) Control Failure Risk.  These two concepts together (the account- or disclosure-related risks and control-related risks) are called "Internal Control over Financial Reporting Risk" or "ICFR" risk.  A diagram was included in the guidance (shown in this section) to illustrate this concept; it is the only such diagram, which indicates the emphasis placed on it by the SEC.  ICFR risk should be associated with the in-scope controls identified above and may be part of that analysis.  This involves the following steps:
caption: SEC risk diagram plus additional captions
exif: {}