Since management’s time is limited, it is crucial to make the best use of any time we’re able to schedule. One way to ensure the time is productive is to scope risk assessment efforts using a pre-assessment survey. Sending a survey before the assessment will help determine if there are any prior or upcoming changes to discuss or if we should carry prior risk ratings forward.
Example questions include:
Always remember that SOX is a moving target. The point of the SOX Act is to help prevent and detect fraudulent financial statements through a comprehensive control environment. Since the risk landscape changes, the control environment is also subject to changes. By approaching the mid-year SOX risk assessment through a series of activities meant to capture meaningful information while reducing the burden to management, we can make the most of the assessment.