Subject: File No. 4-511
From: Adrian D. Thomas, CIA
Affiliation: IIA

February 21, 2006

I hope the SEC will provide more specifics/guidance to public companies on what is adequate/enough for management's assessment (i.e., documentation and testing).

The PCAOB has provided this for the external auditor's assessments (i.e., AS#2). Oftentimes, public companies feel forced to also adhere to the stringent requirements of AS#2 simply because of "push-down" from the external auditor. AS#2 was intended to be a requirement for the external auditor and not management. However without specifics/guidance from the SEC, management will naturally do what the auditor says/expects just to pass. This results in much over-kill, excess, waste, etc.