ICFR Documentation: What Management Must Keep Under SEC Guidance

Management's ICFR conclusion has to be backed by evidence, and the instruction to Item 308 of Regulation S-K says so. What counts as enough documentation is a judgment, and the SEC's interpretive guidance (Release No. 33-8810) explains how to make it. This post turns that guidance into a file index a finance team can keep and a CPA firm can review.

What the guidance requires

Management must maintain reasonable support for its assessment. The guidance, referring to the instructions to Item 308 of Regulations S-K and S-B, says documentation of the design of the controls management has placed in operation to address financial reporting risks, including the entity-level and other pervasive elements necessary for effective ICFR, is an integral part of the reasonable support. The form and extent vary with the size, nature and complexity of the company. It can take many forms, for example paper or electronic, and can be presented as policy manuals, process models, flowcharts, job descriptions, documents, internal memoranda and forms.

The documentation does not need to include all controls that exist within a process that affects financial reporting. It should focus on the controls management concludes are adequate to address the financial reporting risks. Design documentation also serves as evidence that controls and changes to them have been identified, can be communicated to the people who perform them and can be monitored.

For operating effectiveness, the guidance says management's assessment must be supported by evidential matter that provides reasonable support. That includes the basis for management's assessment and documentation of the methods and procedures management uses to gather and evaluate evidence. The nature of the evidential matter varies with the assessed ICFR risk of the underlying controls. In smaller companies where daily interaction provides the evidence, documentation would include how that interaction provided sufficient evidence, which may be memoranda, emails and instructions to personnel. The guidance adds that separately maintained documentation in certain areas will assist the audit committee in its oversight, and that documentation of how management reached its conclusion on the entity-level and other pervasive elements would ordinarily be included.

A file index

Worked example: documenting one control

Control: monthly bank reconciliation review.

• Design. Narrative: the staff accountant prepares each account's reconciliation by business day 4; the controller reviews by day 6, agreeing the bank balance to the statement, the book balance to the ledger, and investigating reconciling items older than 30 days. RCM row ID C-14 records the risk (unrecorded or misappropriated cash), assertion, owner, frequency and evidence.
• Evidence plan. Medium misstatement risk, low control failure risk (simple, experienced staff); plan is to test one month per quarter plus year-end.
• Operation. For the tested month: the reconciliation with preparer and reviewer sign-offs and dates, the bank statement, the ledger report, the aged reconciling item list and clearing evidence for items over 30 days.
• Results. Four quarterly tests, no exceptions; year-end reconciliation reviewed on time.
• Conclusion. Effective.

The control's file takes one folder with five documents. Multiply by the key controls to size the project.

Retention

Keep the support long enough to cover audits, SEC comment letters and internal reviews. The statute and rules on retention of audit-related records are separate from this guidance; a CPA firm that keeps its own working papers has its own retention requirements. See /us/blog/audit-record-retention-how-long-to-keep-workpapers.

Test of sufficiency

Ask three questions of each section.

1. Could a competent person who did not do the work follow it and reach the same conclusion? The IIA Standards use the same test for internal audit documentation: Standard 14.6 requires documentation such that an informed, prudent auditor could repeat the work and derive the same results.
2. Does the documentation show the risk behind the evidence chosen?
3. Is there a trail from control to risk to conclusion?

Common gaps

• Narratives that describe the process but not the control.
• Control descriptions with no frequency, owner or evidence.
• Test results without the population and the selection method.
• A deficiency log with no evaluation memo behind the severity rating.
• No documentation of entity-level controls.

Related reading

• /us/blog/risk-and-control-matrix-guide
• /us/blog/internal-control-questionnaire-and-walkthroughs

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• SEC, Release No. 33-8810, Section II.A.1.e (Evidential matter to support the assessment) and Section II.A.2.c: https://www.sec.gov/rules/interp/2007/33-8810.pdf
• The IIA, Global Internal Audit Standards (2024), Standard 14.6 Engagement Documentation: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error