Certifying officers can use a variety of tools to perform their DC&P and ICFR evaluations. These tools include:
(a) certifying officers’ daily interaction with the control systems;
(b) walkthroughs;
(c) interviews of individuals who are involved with the relevant controls;
(d) observation of procedures and processes, including adherence to corporate policies;
(e) reperformance; and
(f) review of documentation that provides evidence that controls, policies or procedures have been performed.
Certifying officers should use a combination of tools for the DC&P and ICFR evaluations. Although inquiry and observation alone might provide an adequate basis for an evaluation of an individual control with a lower risk, they will not provide an adequate basis for the evaluation as a whole.
The nature, timing and extent of evaluation procedures necessary for certifying officers to obtain reasonable support for the effective operation of a component of DC&P or ICFR depends on the level of risk the component of DC&P or ICFR is designed to address. The level of risk for a component of DC&P or ICFR could change each year to reflect management’s experience with a control’s operation during the year and in prior evaluations.