Disaster recovery planning: what section 404 audits reveal

• Published in: The CPA journal (1975) 2007-12, Vol.77 (12), p.60
• Main Authors: Hermanson, Dana R, Ivancevich, Daniel M, Ivancevich, Susan H
• Format: Article
• Language: English
• Subjects: Accounting and auditing; Analysis; Back up systems; Contingency planning; Customer relationship management; Disaster recovery; Emergency management; Financial reporting; Internal controls; Methods; Onsite; Planning; Product development; Public companies; Public Company Accounting Reform & Investor Protection Act 2002-US; Publicly held corporations
• ISSN: 0732-8435

This article summarizes recent Sarbanes-Oxley Act (SOX) section 404 internal control reports that reveal material weaknesses due to inadequate disaster recovery planning. Section 404 currently applies to public companies with over $75 million in public float. Using the Audit Analytics database, the authors searched for reported material weaknesses in internal control from November 2004 (the effective date of section 404) through Aug 29, 2006, to identify which ones specifically related to disaster recovery plan (DRP). Among the 16 companies, there are 10 cases in which the deficiency appears to involve a general failure to implement a DRP or backup and recovery plan. In the event of a disaster, such companies would risk catastrophic damage, including the inability to file financial reports. SOX section 404 audits reveal some public companies with significant DRP-related weaknesses, and several indicated that remedial efforts were underway. The authors believe that many more private and small public companies are facing such challenges as well.