This is one of the most serious and onerous requirements imposed by SOX. The CEO and CFO are expected to be able to demonstrate that there is a reliable process in place to evaluate, at least quarterly, the controls in place to ensure the reliability of the data being produced by the Disclosure Staging Area and all DOPs. It is important to note that looking at controls in a vacuum without understanding and evaluating the risks that threaten disclosure objectives will produce sub-optimal results and is inconsistent with the principles in the new draft COSO framework scheduled for release in April 2003. The omission of risk identification and assessment in the assessment process should be considered a significant risk in its own right. Very few companies have formally documented the end result DOPs that support SEC disclosures, the risks
to those DOPs, the controls used to mitigate those
risks, and current performance data (i.e. the
frequency that the Disclosure Staging Area(s) and
DOPs produce errors or omissions).