Ok, we have to have an auditor's opinion on management's 404 assertion in our 6/30/06 financials. I am working on our documentation this quarter, we hope to have external auditors review when they are here for 6/30/05 financials.

I am having a hard time getting my brain around the narratives for the business processes. I have looked at different software, hoping for something tailored to banks. I have been unable to locate anything. Anyone know of anything? Any product at all that would help me with the narratives?

Secondly, would someone be willing to share a simple process narrative (something simple like deposit receipts, or account openings?) - our auditors have given us "example forms," and I have picked up a few other example forms from other sources, but no narratives, and I am really struggling with how to develop these.

Thanks in advance for any help.

This is a miserable process and each auditing firm/auditor is requiring something different. I do have a document I can share on our branch process - it covers everything "SOX" in our branch process. PM me with your email.

I recommend using Visio to flowchart the processes, with a brief narrative to expand on significant parts of the flowchart. The CPA's usually prefer flowcharts and their are easier to validate with line management.

We convinced our auditors to back off of the flowchart idea and accept a business process control matrix that identifies each significant process done by each line of business. The matrix for each line of business serves as the audit planning document for the Sarbanes Oxley reviews in each of the 5 required area of assertion.

Our externals refused to accept any chart or matrix as documentation. They insisted upon very detailed narrative descriptions that explain everything that is done in the identified areas that affect the financial statements (lending, investments, deposit operations, IT, etc.). We do have a matrix of all identified risks and controls in those areas, any identified gaps, action plans, materiality, and risk assessment.