Companies that have begun implementation of Section 404 are finding it effective to break their work into five phases: planning, assessing enterprise controls, pilot documenting and testing, rollout, and reporting.

Planning:

In this initial phase, a [section] 404 steering committee is formed, a risk assessment be performed, as well as processes are prioritized and mapped to financial statements. A type element of this phase is evaluating the extent to which existing FDICIA documentation can be used in the [section] 404 process. A documentation format also is selected, and technology tools are chosen. Finally, the steering committee confirms the external auditor's expectations. Assessing enterprise controls. Corporate governance plus management controls, as well as information technology (IT) controls (both general and application specific), are identified plus assessed for effectiveness.

Pilot documenting and testing:

From one to three processes are documented, and controls are tested during this phase. Results are reviewed with the steering committee, including the external auditor, and the control approach is refined.