We are a reporting bank for SOX in 2005. I've read all the SOX posts I can find on this board. Management decided to internalize the testing process for SOX vs. paying gobs of $$ to have Crowe or Plante do the testing. Are there other banks out there that did this for last year? What worked well, what was a disaster? We're having our kickoff tomorrow with Plante. I appreciate any and all feedback. Kaybee if you are reading this, I would really appreciate it if you would PM me. I haven't been able to reach you - I know you have been involved in SOX at your bank.

Thanks everyone

I just pm'd you with my work email and number.

We did use and outside firm to help with the documentation and testing this year. It was expensive but they were great and a tremendous help and provided shoulders to cry on! What a harrowing experience...equals BSA and about as much payback.

Much depends upon who your outside firm is. Our externals required incredible detail and had hot buttons (like FAS 91) they harped on. We actually found some stuff in FAS 91 we had to fix but it was immaterial to our financials and we convinced them of compensating controls.

I know other banks where FAS 91 didn't even come up. We seem to have emerged older, wiser, and with no material weaknesses as far as we know.

The testing is tricky. Hopefully your externals will at least share their expectations re sample sizes so you know what to shoot for. Ours wouldn't and then would say "that's not enough" (sort of like banking regulators).

What they expect in documentation can vary as well. We had to write very detailed documents that explained processes from beginning to end, and in the document state the risks and the controls. Other places I know were able to use audit documentation. Didn't fly with KPMG.

But we have great documentation now that will really add value to our audit process!

The fun part is when you do your testing in the 3rd or early 4th quarter and then have to go back and do 'roll forward' testing through year end.

Give me a buzz. The OCC won't be in tomorrow or Friday!

We got their sample sizes after they said

Quote:

---

"that's not enough"

---

.

Quote:

---

The fun part is when you do your testing in the 3rd or early 4th quarter and then have to go back and do 'roll forward' testing through year end.

---

And wasn't that a crock of ......!!!!!

I'm glad to hear that it wasn't just us!!

We got their sample sizes after they said

Quote:

---

"that's not enough"

---

.

Quote:

---

The fun part is when you do your testing in the 3rd or early 4th quarter and then have to go back and do 'roll forward' testing through year end.

---

And wasn't that a crock of ......!!!!!

I'm glad to hear that it wasn't just us!!

CCB, We used Crowe and their Lotus Notes. It actually went very well. We are an accellerated filer. We had our final meeting on issues this week. Now our 404 Modules are ready (replacing the FDICIA modules)for 2005 auditing. Sample sizes required by Crowe was 33. But if one error was found in the 33, then you had to add 25 more. Needless to say, the number 58 came up a lot!! Good luck!!

Internal, how big is your institution? We are familiar with Crowe and know that they are well versed in SOX. The trouble is that they want much more money than what the board and audit committee are willing to pay. I'm curious how much involvement there was between you and Crowe. Did they help with the mapping of accounts or anything else specific?

We are also going with Crowe Chizek this summer. My bet is that your BOD will reconsider the cost... soon.