page_title: SOX 404 top–down risk assessment
section_title: Consider the impact of risk on the timing, nature, and extent of testing
hierarchical_section_title: SOX 404 top–down risk assessment / Considerations in testing and evidence decisions / Consider the impact of risk on the timing, nature, and extent of testing
caption_attribution_description: English: Evidence Sufficiency Diagram for SOX TDRA
context_page_description: In financial auditing of public companies in the United States, SOX 404 top–down risk assessment is a financial risk assessment performed to comply with Section 404 of the Sarbanes-Oxley Act of 2002. The term is used by the U.S. Public Company Accounting Oversight Board and the Securities and Exchange Commission. The TDRA is used to determine the scope and required evidence to support management's testing of its internal controls under SOX404. It is also used by the external auditor to issue a formal opinion on the company's internal controls. However, as a result of the passage of Auditing Standard No. 5, which the SEC has since approved, external auditors are no longer required to provide an opinion on management's assessment of its own internal controls.
  Detailed guidance about performing the TDRA is included with PCAOB Auditing Standard No. 5 and the SEC's interpretive guidance "Management's Report on Internal Control Over Financial Reporting". This guidance is applicable for 2007 assessments for companies with 12/31 fiscal year-ends.
context_section_description: The guidance provides flexibility in the timing, nature and extent of evidence based on the interaction of Misstatement Risk and Control Failure Risk (together, ICFR Risk). These two factors should be used to update the "Sampling and Evidence Guide" used by most companies. As these two risk factors increase, the sufficiency of evidence required to address each MMR increases.
  Management has significant flexibility regarding the following testing and evidence considerations, in the context of the ICFR risk related to a given control:
  Extent (sample size):  The sample size increases proportionally to ICFR risk.
  Nature of evidence:  Inquiry, observation, inspection and re-performance are the four evidence types, listed in order of sufficiency.  Evidence beyond inquiry, typically inspection of documents, is required for tests of control operating effectiveness.  Re-performance evidence would be expected for the highest risk controls, such as in the period-end reporting process.
  Nature of the control (manual vs. automated):  For fully automated controls, either a sample size of one or a "benchmarking" test strategy may be used.  If IT general controls related to change management are effective and the fully automated control has been tested in the past, annual testing is not required.  The benchmark must be periodically established.
  Scope of roll-forward testing required:  As risk increases, roll-forward testing is increasingly likely to be necessary to extend the effect of interim testing to year-end.  Lower-risk controls presumably do not require roll-forward testing.
  Pervasive factors that also affect the evidence considerations above include:
  Overall strength of entity-level controls, particularly the control environment:  Strong entity-level controls act as a pervasive "counter-weight" to risk across the board, reducing the sufficiency of evidence required in lower-risk areas and supporting the spirit of the new guidance in terms of reducing overall effort.
  Cumulative knowledge from prior assessments regarding particular controls: If particular processes and controls have a history of working effectively, the extent of evidence required in lower-risk areas can be reduced.
caption: Impact of ICFR risk on timing, nature and extent of testing
exif: {}