Use Change Documents for Sarbanes-Oxley Compliance Testing
- by Qian Sharon Tang, System Program Manager
- June 15, 2005
The time for Sarbanes-Oxley Act of 2002 testing is now. Find out how to leverage existing hidden system resources in R/3 to help fulfill some of the crucial Sarbanes-Oxley Act mandates.
For compliance with Section 404 of the Sarbanes-Oxley Act, many public companies have taken a two-phased approach to assess the effectiveness of internal controls over financial reporting. The first phase is identifying the controls to test. Types of controls include controls over authorizing, initiating, recording, processing and reporting transactions, and antifraud controls. The next phase involves tests of operating effectiveness. When testing, determinations need to be made as to whether the control is operating as designed, and whether the person performing the control function possesses the necessary authority and qualifications. Tests of controls include inquiry, observation, inspection, and re-performance.
The inspection and testing of internal controls required by Section 404 of the Sarbanes-Oxley Act of 2002 involves vigorous reviews of extensive audit trails. It also means logging changes to records of critical business data to detect any errors or fraud that could result in material misstatement of the financial information.
With Sarbanes-Oxley compliance as a pressing concern, many companies are left without sufficient time to plan implementation and testing, let alone to identify new or untested suites of comprehensive testing tools. One testing tool that's readily available and can be easily leveraged, however, is the extensive body of change documents already found in R/3.
Change documents are R/3 documents that detail changes to master records, tables, documents, and so on, when certain conditions are met. R/3 automatically logs who made what changes to business data objects in these change documents. I'll cover standard change document reports, how to retrieve change document information from areas not covered by the standard reports, and the change document programs included in R/3 that I've found most useful.
Would you like to see this full item?