SOX 제어 테스트의 AI

Section 404 of the Sarbanes-Oxley Act requires management to assess internal control over financial reporting (ICFR), usually against the COSO 2013 framework. For larger filers, it also requires the external auditor to attest to that assessment. Auditors do this work under PCAOB AS 2201. Testing a control usually involves understanding the process through a walkthrough, evaluating whether the control is designed properly, and testing whether it operated effectively across the period. AI is useful in three places. First, walkthrough documentation. Speech-to-text and language models can draft process narratives, flowcharts and risk-control matrices from interviews and system documents. A draft is not a walkthrough, though. Under AS 2201 a walkthrough follows a transaction through the process, using inquiry together with observation, inspection and re-performance. Second, evidence review. Document extraction can read approvals, dates, ticket fields and reconciliations, and rules can check attributes across a whole population rather than a sample of 25. Third, segregation of duties. Tools analyze ERP security data to find users with conflicting capabilities, such as creating vendors and approving payments. Specialized access-governance products do this for SAP and other ERPs, and AI helps interpret custom transactions and group roles. Several cautions apply. System-generated reports that feed any test are information produced by the entity, and their completeness and accuracy must be tested. If management uses AI to perform a control, the AI itself needs IT general controls and change management. When the auditor uses tests management performed with AI, AS 2201's framework for using the work of others applies, including the others' competence and objectivity. A common misconception is that automation makes controls effective. It only tests them faster. A second is that full-population testing removes the need to judge whether exceptions are control deficiencies, and if so, how severe.