Sarbanes-Oxley Section 404 Documentation and Testing Software

2006-2008 Cost Advisors, Inc.

Cost Advisors Background

Founded 9 years ago 15-person company exclusively SarbanesOxley for last 5 years Collaborated with all Big 4 firms and public companies to design SarbOxPro Published Guide for managing SarbanesOxley projects in the Internal Auditor magazine Published SOX Illustrated a 200 page book on SOX SOX Instructor for Oregon Society of CPAs

2006 - 2008 Cost Advisors, Inc.

Fast, Easy Documentation & Testing Software

Easy Input Easy to Use Easy Output

Our goal is to make your SOX 404 Project fast, easy, and affordable

2006 - 2008 Cost Advisors, Inc.

SarbOxPro Features
Easy Input Fast and easy installation on any PC or existing shared drive Import data directly from Excel (or use pre-populated data) Easy To Use Control and testing libraries Intuitive 'Tree' structure Organize Visio, Excel, and Word Documents Schedule tests and keep a history of test results Easy Output Read SarbOxPro data with pre-formatted Pivot Tables in Excel Export to Excel Pre-formatted Access Reports
2006 - 2008 Cost Advisors, Inc.

Ideal Users
Small to medium size public companies Limited budget Geographically concentrated controls Committed to Microsoft Office Accelerated filers with completed project data in Excel Non-accelerated filers needing guidance and prepopulated processes, risks and controls

2006 - 2008 Cost Advisors, Inc.

SarbOxPro is Right for Many Companies

Excel Share controls and tests between documenters Ensure pre-defined and uniform data capture Run consolidated reports for all documenters Easy to setup Custom reports in Excel Responsive (no latency) Low Cost E-Mail notification # Simultaneous users 1

SarbOxPro

Web-Based maybe

about 5 dozens

2006 - 2008 Cost Advisors, Inc.

Without SarbOxPro

2006 - 2008 Cost Advisors, Inc.

With SarbOxPro
Flowcharts Visio

Narratives in Word

Link

Lists of Items Tested 1. Pass/ Fail x 2. x 3. x 4. 5. 6. x

2006 - 2008 Cost Advisors, Inc.

SarbOxPro Versions
Free Version Fully-functional software, no time limit, no user limit Pre-populated processes, risks and controls Excel Pivot Table Reports Flowchart & Test Templates 2 hours telephone SOX 404 consulting Free E-mail support
(10 incidents per year)

$3500 Version X X

Maintenance $995 per year

17 X X X X

Free upgrades
2006 - 2008 Cost Advisors, Inc.

Sarbanes-Oxley 404 Consulting Available

Project scoping Preparation of documentation Risk assessment Testing Segregation of Duties analysis Project management Education and training Excel data clean up

2006 - 2008 Cost Advisors, Inc.

10

Customer Quotes
"We are very pleased with the SarbOxPro software. It is integrated with the standards set by the PCAOB and is quite user friendly. It was an excellent tool in our planning process and has helped us in our documentation of our internal controls. We believe the pricing is very fair." Gery Richards, Senior Accountant, Ramtron International Many benefits and efficiencies were realized through the application of SarbOxPro to our compliance efforts: Creates a flow of documentation that ensures our approach is complete. Links all the information together for easy comprehension and minimal training for current and future staff. Great central storage for all documentation. Allows the user to customize screens. Creates a testing log and schedule. Director of Internal Controls Oil & Gas Company I find the SarbOxPro software very useful in giving me and my client a structure and an outline to follow as we document and test the scope and adequacy of the company's internal control structure and procedures for financial reporting. Sonny Sano, Business Consultant
2006 - 2008 Cost Advisors, Inc.

11

Product Organization
Set up optional company data Create a back up of your data

Retrieve reports

Input project data

User Guide

2006 - 2008 Cost Advisors, Inc.

12

Initial Configuration: Set Up Data for Your Company

Customize field drop downs

Built-in risk evaluation tool determines the inherent process risk and risk of control failure.

Easy to import project data from Excel

2006 - 2008 Cost Advisors, Inc.

13

Main Menu: Data Input

2006 - 2008 Cost Advisors, Inc.

14

SarbOxPro Data Tree Structure

Cycle Process Objective Risk Control Test

2006 - 2008 Cost Advisors, Inc.

15

SarbOxPro Data Tree Structure

Cycle = A group of processes performed to accomplish an objective (i.e. Revenue or Financial Reporting cycle) Process = A subset of a cycle. (i.e. The Sales Order process, Credit Approval process, and Invoicing processes are all components of the Revenue cycle) Objective = The goal of a process or transaction based on managements assertions (i.e. Invoices with non standard pricing (exceptions) are reviewed and approved by the appropriate level of management) Risk = The possibility that an objective will not be met. (i.e. Invoices are not accurately input and processed both individually and in the aggregate). Control = Mitigates risk (i.e. Exceptions to standard pricing and discounts require specific management approval). Test = A check that the control is working (i.e. Verify evidence of management approval for price exceptions).

2006 - 2008 Cost Advisors, Inc.

16

Example: Financial Reporting Cycle

Monthly GL Close Process

Financial Reporting

Cycle

+ + +

FIN-01 Chart of Accounts FIN-02 Estimates & Accruals FIN-11 Disclosures FIN-12 Close GL
Process Objective

Obj FIN-12.A All JEs are booked

+ +

Risk FIN-12.A.1 Subledgers are incomplete Risk FIN-12.A.2 Subledgers accum. Incorrectly Risk FIN-12.A.3 Unposted JEs EXPTEST-001
Risk Control

FINCTRL-013 Closing checklist is used

Test

2006 - 2008 Cost Advisors, Inc.

17

Three Sections of Data Input

In the Data Tree Area you can see the hierarchy of Process, Risks and Controls.

In the Detail Area you can see the specific info for the single item selected in the Data Tree.

In the Library Area you can see the entire list of accounts and tests.

2006 - 2008 Cost Advisors, Inc.

18

Overview Data Input

Easily use the Data Tree Input form with pre-loaded data or add your own. You can also add, modify and delete Risks and Controls here.

2006 - 2008 Cost Advisors, Inc.

19

Process Level Data

Enter process level data here.

2006 - 2008 Cost Advisors, Inc.

20

Process Level: External Links

Visio Data

SarbOxPro can reference external project documents such as Visio flowcharts, Word narratives, and Excel test plans.

2006 - 2008 Cost Advisors, Inc.

21

Process Documentation

SarbOxPro calculates a comprehensive risk weighted score for each process based on the weight and score assigned by the user.

2006 - 2008 Cost Advisors, Inc.

22

Segregation of Duties

Employees - Segregation of duties issues exist when a single individual does too much. Identify the people who perform each transaction and later run a report showing Segregation of Duties conflicts.

2006 - 2008 Cost Advisors, Inc.

23

Objectives
Identify relevant assertions for each Objective.

Objectives are determined by assertions. Assertions describe what is correct about financial processes. The standard PCAOB assertions are built into SarbOxPro.

2006 - 2008 Cost Advisors, Inc.

24

Risks

Click this button to evaluate the deficiencies found.

Use the SarbOxPro pre-populated risks, import risks from Excel or write new risks.

2006 - 2008 Cost Advisors, Inc.

25

Deficiency Evaluation Form

This form is available for risk and testing menus. It can be used to document both design deficiencies and operating (testing) deficiencies. The form is designed to capture deficiencies noted by the project team plus remediation plans from process owners. Reports are available to summarize the status of deficiencies.
The Determine Classification button in the Deficiency Evaluation Form will direct you to the Deficiency Classification Form (see next slide).

2006 - 2008 Cost Advisors, Inc.

26

Deficiency Classification
This interactive flowchart is used to evaluate the severity of a deficiency as a Deficiency, Significant Deficiency or Material Weakness. The flowchart follows COSO standards.

The flowchart branches to successive questions based on answers to simple yes / no questions.

2006 - 2008 Cost Advisors, Inc.

27

Controls

Use SarbOxPro pre-populated controls, import controls from Excel or write new controls. Also enter control details and rate risk of control failure.

2006 - 2008 Cost Advisors, Inc.

28

Control Details

Enter control details.

Rate risk of control failure.

2006 - 2008 Cost Advisors, Inc.

29

Test Data

Enter test results by location. 2006 - 2008 Cost Advisors, Inc.

30

Main Menu: Reports

2006 - 2008 Cost Advisors, Inc.

31

Reporting From SarbOxPro

Formatted Access Reports

1. Display & Print

2. Export
SarbOxPro

Use pre-formatted Excel pivot table to read SarbOxPro data.

3. Read

2006 - 2008 Cost Advisors, Inc.

32

Report Menu

View or print reports or export data to Excel.

2006 - 2008 Cost Advisors, Inc.

33

Pre-formatted Access Reports

2006 - 2008 Cost Advisors, Inc.

34

Reports Excel Reporter (Pivot Tables)

SarbOxPro Excel Reporter allows you to read live data in Excel pivot table format saving time from exporting the data to Excel every time the data changes.

2006 - 2008 Cost Advisors, Inc.

35

Need more information?

Download a free copy of SarbOxPro online at: www.SarbOxPro.com Call us for a demonstration: 503-646-3500 Receive fast responses to your specific questions by E-mailing: Sales@SarbOxPro.com
2006 - 2008 Cost Advisors, Inc.

36