Share your expert advice, industry best practices, general tips & tricks you've picked up while working in Governance, Risk and Compliance and the like.
Annually, we perform a self assessment of SOX controls and provide an assessment at the component level to our external auditors. We follow the 2013 COSO guidance, but I feel that this process is not only time intensive and very manual, but flawed...
Hi, For each control we have a test phase for Test of Control Design. Last year we uploaded 3 files that made a matrix table from each file for each individual control that was our assessment for each. Because not much changes in the design of a c...
We periodically get questions from our auditors about changes within our SOX environment - for example, creation of new controls, changes in control significance, key reports, or systems. I have seen the 'Data History' report that is available, b...
Are there Excel settings we need to be aware of and set so that after uploading to SOX/Audit workspace the file is displayed correctly in the evidence/markup viewer? Some sheets display fine, but others will display a few columns over a few pages....
Our company went public in 2018, we have been diligently working to get up to SOX404 standards. In 2019 one of our major requirements was creating a repository and baseline testing of all of our Key Reports (ITDCs). We are now looking for the mo...
Hello All, Has anyone had success exporting audit data (workpapers, files, etc) from another tool (such as AutoAudit) and then import into WDesk? We were able to export/import our Action Plans, but not the associated files. Other than that, we are...
I am thinking of adding a test phase for the Key Report/IPE testing. As these are tested on creation and then every so many years, I am not sure if I can create a link to a previous years test. how are people tracking the Key report/IPE testing?
We are looking at getting away from emails for requesting/collecting PBCs in the generation of our 10-K. Does anyone have any experience or recommendations on this? We have both SEC reporting and Controls Management workspaces, but we are wanting ...
Does anyone utilize certifications for controls owners/process owners to certify attributes related to IPE? If so, can you provide the questions you ask?
We have just recently started using wDesk and want to give our external auditors access to some of our testing. We've added the relevant people as users that have external audit roles; we've put them in a group called External Audit, and we've gi...
I'm looking for any tips and tricks related to the Issue and Action Plan sections of the SOX database. We are getting ready to use this feature and are looking for some best practices.
We are looking for a way to manage management response to control deficiencies within Wdesk. We would love to hear how other clients are doing this, there doesn't seem to be a formalized way to gather this information from the business owners onc...
I can't find any instructions on how to create a new Audit Program. I am setting up a new ISO 27K Readiness Audit Program and can't seem to understand how to create the audit program and related data to which I can add test forms for each ISO cont...
Has anyone had to update SOX control numbers during the course of a year? If so, what happens to the previous control numbers?
Our internal controls department is concerned with how to explain access for Workiva Support users. If they have access to make changes what controls to we have around knowing if they made a change/altered a document.
Is anyone using "Workflows" for Audit PBC's? If so, any feedback you can share? I'm looking for a way to gather the necessary PBC its for out audits outside of the usual sharepoint or constant mass emails. Thank you in advance.
We just finished our first year SOX program as a company (and with Workiva SOX). We, and our auditors were not happy with the layout and detail in our SOX narratives. We basically ended up relying on the RACM and flows. Anyone have a good sourc...
