As your Sarbanes-Oxley project moves toward a process approach, it is important to standardize the documentation of internal controls. This presentation serves as a guide for successfully achieving that standardization. Sections in this presentation include: outlining what to document, how to do it and to what extent; understanding the documentation road map; identifying and assessing key risks; and performing walk-through procedures.

When documenting processes, risks and control activities:

• Use the Process Classification Scheme to identify key processes that materially affect priority financial reporting elements.
• Document input, activities and outputs for each subprocess. Source risks and identify key control points.
• Identify related process risks for each subprocess.
• Compare process flows to current procedures, identify gaps, and develop and update procedures, as necessary.
• Utilize a company-specific process map for each subprocess.
• Implement a process-specific risk/control matrix.