Share your expert advice, industry best practices, general tips & tricks you've picked up while working in Governance, Risk and Compliance and the like.
What's the best design/configuration for Quarterly PBC Requests e.g. application's user access reports/outputs and certifications/reviews? Audit Program - SOX <Year> Test Phase - Q1, Q2, Q3 or Q4? Control - Control ID for the SOX App/System's quar...
We are working to set up our data in Wdesk and are trying to plan ahead on how to handle secondary controls. Does anyone else renumber secondary controls when they change their risk profile? If so, what format have you used for control numbering...
We are looking for a RACI template to define Support responsibilities between Accounting and Systems Support.
Hello- We are trying to better visualize and map out our Policies & Procedures and how they reference exact lines of the specific regulatory document that the policy references across our entire organization. I have brought in both sets of documen...
I would be interested in how everyone (Audit or SOX) handles other observations. In an audit, occasionally you may come across an item that is not a risk, but more of an efficiency or good practice to do that would be beneficial to the client. I...
I was curious to see how others use Workiva to complete their vendor's SOC 1 reviews. Currently, within Workiva we use a large spreadsheet document, and create individual SOC 1 has a few of a standardized review template. SOC 1 reviewers attach t...
Has anyone used Internal Control Questionnaires (ICQ) in their Internal Control process. These ICQ's were compiled by the National Association of State Auditors, Comptrollers and State Treasurers, NASACT in 2013. Our state has numerous agencies t...
Good Afternoon All, I was wondering how your organizations are using Workiva (Wdesk) for fraud risk assessments. Is there a particular approach you have found to be most helpful? Thanks for your feedback!
We are an outside CPA firm, and we perform ICFR (SOX) testing for for several entities that use Workiva. We are trying to understand how to coordinate our testing within the Workiva platform. My understanding before reading articles in the Help ...
Hi I would like to know the quickest way to backup all files/test forms/reports (pretty much all data) from workiva to my computer. I can create a snapshot but do not see how to export it. Is there a better alternative? Thanks.
I'm finding I don't love the layout of ours and that they're difficult to follow, have some unnecessary fields, have some redundancies, and it's just time for a refresh. I was curious if there are any folks out there who have found their layouts t...
Annually, we perform a self assessment of SOX controls and provide an assessment at the component level to our external auditors. We follow the 2013 COSO guidance, but I feel that this process is not only time intensive and very manual, but flawed...
Hi, For each control we have a test phase for Test of Control Design. Last year we uploaded 3 files that made a matrix table from each file for each individual control that was our assessment for each. Because not much changes in the design of a c...
We periodically get questions from our auditors about changes within our SOX environment - for example, creation of new controls, changes in control significance, key reports, or systems. I have seen the 'Data History' report that is available, b...
Are there Excel settings we need to be aware of and set so that after uploading to SOX/Audit workspace the file is displayed correctly in the evidence/markup viewer? Some sheets display fine, but others will display a few columns over a few pages....
Our company went public in 2018, we have been diligently working to get up to SOX404 standards. In 2019 one of our major requirements was creating a repository and baseline testing of all of our Key Reports (ITDCs). We are now looking for the mo...
Hello All, Has anyone had success exporting audit data (workpapers, files, etc) from another tool (such as AutoAudit) and then import into WDesk? We were able to export/import our Action Plans, but not the associated files. Other than that, we are...
I am thinking of adding a test phase for the Key Report/IPE testing. As these are tested on creation and then every so many years, I am not sure if I can create a link to a previous years test. how are people tracking the Key report/IPE testing?
We are looking at getting away from emails for requesting/collecting PBCs in the generation of our 10-K. Does anyone have any experience or recommendations on this? We have both SEC reporting and Controls Management workspaces, but we are wanting ...
Does anyone utilize certifications for controls owners/process owners to certify attributes related to IPE? If so, can you provide the questions you ask?
We have just recently started using wDesk and want to give our external auditors access to some of our testing. We've added the relevant people as users that have external audit roles; we've put them in a group called External Audit, and we've gi...
I'm looking for any tips and tricks related to the Issue and Action Plan sections of the SOX database. We are getting ready to use this feature and are looking for some best practices.
We are looking for a way to manage management response to control deficiencies within Wdesk. We would love to hear how other clients are doing this, there doesn't seem to be a formalized way to gather this information from the business owners onc...
I can't find any instructions on how to create a new Audit Program. I am setting up a new ISO 27K Readiness Audit Program and can't seem to understand how to create the audit program and related data to which I can add test forms for each ISO cont...
Has anyone had to update SOX control numbers during the course of a year? If so, what happens to the previous control numbers?
Our internal controls department is concerned with how to explain access for Workiva Support users. If they have access to make changes what controls to we have around knowing if they made a change/altered a document.
Is anyone using "Workflows" for Audit PBC's? If so, any feedback you can share? I'm looking for a way to gather the necessary PBC its for out audits outside of the usual sharepoint or constant mass emails. Thank you in advance.
We just finished our first year SOX program as a company (and with Workiva SOX). We, and our auditors were not happy with the layout and detail in our SOX narratives. We basically ended up relying on the RACM and flows. Anyone have a good sourc...
