(1) General – Reperformance is the independent execution of certain components of the issuer’s DC&P or ICFR that were performed previously. Reperformance could include inspecting records whether internal (e.g., a purchase order prepared by the issuer’s purchasing department) or external (e.g., a sales invoice prepared by a vendor), in paper form, electronic form or other media. The reliability of records varies depending on their nature, source and the effectiveness of controls over their production. An example of reperformance is inspecting whether the quantity and price information in a sales invoice agree with the quantity and price information in a purchase order, and confirming that an employee previously performed this procedure.
(2) Extent of reperformance – The extent of reperformance of a component of DC&P or ICFR is a matter of judgment for the certifying officers, acting reasonably. Components that are performed more frequently (e.g., controls for recording revenue) will generally require more testing than components that are performed less frequently (e.g., controls for monthly bank reconciliations). Components that are manually operated will likely require more rigorous testing than automated controls. Certifying officers could determine that they do not have to test every individual step comprising a control in order to conclude that the overall control is operating effectively.
(3) Reperformance for each evaluation – Certifying officers might find it appropriate to adjust the nature, extent and timing of reperformance for each evaluation. For example, in “year 1”, certifying officers might test information technology controls extensively, while in “year 2”, they could focus on monitoring controls that identify changes made to the information technology controls. Certifying officers should consider the specific risks the controls address when making these types of adjustments. It might also be appropriate to test controls at different interim periods, increase or reduce the number and types of tests performed or change the combination of procedures used in order to introduce unpredictability into the testing and respond to changes in circumstances.