This section: expand/collapse   All sections: expand/collapse

---

CERTRACK is a web-based system that allows firms to efficiently manage their internal control certification process by providing a secure platform for the documentation, testing and reporting of internal controls, managed in a structured and auditable manner. As a web-based application, users would only need an Internet connection and a web browser to access the system. CERTRACK allows users to utilize its features over the Internet.

Log in: CERTRACK uses a single-sign-on system, which enables multiple individuals to access data from CERTRACK simultaneously and in real-time. The data being accessed will depend on the user role, which could be an administrator, an auditor and/or a reviewer. In addition, CERTRACK keeps track of the complete access logs for different roles, and provides extensive security features for user authorization and authentication.

Security: CERTRACK's network connectivity is encrypted using 128-bit data encryption, and there is a firewall existing between the production environment and the public domain. Access to data and application is restricted based on user roles, and audit trails are enabled for the different roles. In addition, all employees of SyncBASE Inc. have signed the non-disclosure agreement and the privacy agreement.

Backup and Recovery: The CERTRACK application is backed-up on a daily basis, and a comprehensive backup strategy is in place to protect client data against computer equipment failures. Moreover, the backup media is stored in an off-site location.

Implementation: Users of CERTRACK will go through on-line training sessions with our designated trainers to get started. CERTRACK staff will take the responsibility of loading client’s existing data into the system if there is any, and will set-up as many user accounts as the client may need.

Support: : CERTRACK has a highly professional support team dedicated to the queries and needs of our clients. The support phone number and email address are published on our website, and there is a hunt group established on the phone system to provide 24-by-7 support. To view the support team profiles, please click here .

This section: expand/collapse   All sections: expand/collapse

---

The purpose of the set-up is to ensure a smooth and painless migration to CERTRACK from the previous means of managing internal controls through a customized set-up and implementation.

General Set-up:

• User Profile and information, such as their roles and contact information
• Company location and departments, if any
• Company calendar, including company quarter ends and/or year ends
• Company financial statements and existing risk assessment
• Company existing processes and controls, if any
• Process existing narrative and flowcharts, if any
• Any existing testing papers

Customized Set-up:

• If your firm has already documented your internal controls, these will be uploaded onto the system as part of the regular set-up
• If your firm has not documented internal controls, you can utilize our control templates and questionnaires which contain hundreds of samples for internal controls and process risks

This section: expand/collapse   All sections: expand/collapse

---

CERTRACK introduces a unique framework and methodology that allows a firm to complete their internal control audit through a top-down risk based approach that involves different members (process owners, management, external auditors, etc.) from different operations (accounting, sales, human resource, IT, etc.) from various locations (head office, oversea locations, etc.) within a single online platform.

Risk Assessment: By looking at the financial statements of the recent period, based on the account balances, CERTRACK calculates the materiality of the accounts based on the COSO guidance from both quantitative and qualitative perspective.

Process Narrative and Walkthrough: Based on the user profile, CERTRACK provides a simple and easy template to fill in Walkthrough and/or Narrative information, which are date stamped. At a click of a mouse, user may generate a sophisticated Walkthrough and Narrative report or choose to do a comparison between the two. In addition, any walkthrough exhibits can be directly stored in CERTRACK.

Flow Chart: CERTRACK utilizes an online flowchart creation tool to allow users to draw and store their process activity flow, which can be connected to key controls and risks to give a visual representation of a well maintained process.

Control Documentation: In every new audit period, the control documentation is rolled forward, however should it change over time user may choose to change the control attributes and descriptions. CERTRACK provides a complete audit trail on any updates happened to a control at a click of a mouse. Moreover, because all the data is maintained in a single database on CERTRACK, any changes made to a control will be automatically applied to all instances where the control is used in.

Control Testing: Testing information is provided by control owners/ process leaders/ compliance department, including test procedure and method, sample size, and sampling source. Test responsibilities are passed to internal testers or external auditors, who will conduct tests independently through a separate log-on and upload evidences for management review. Similar to the walkthrough exhibits, all testing papers can be directly stored within CERTRACK.

Remediation: Should any deficiencies be discovered, CERTRACK keeps track of the remediation process by allowing the remediation delegates to log-on separately, and provide updates on the progress of the remediation plan implementation.

Progress Charting, Monitoring, and Statistics: During the testing periods, tester performances are constantly monitored. At any time, users can see statistics for tests that are outstanding, completed or behind schedule. Furthermore, users may choose to generate reminder letters or allow CERTRACK to generate automatic alerts to remind testers any uncompleted tasks.

Conclusion and Reporting: Control conclusions are done at the end of the testing process, where the reviewer of each process retrieves the information provided by the testers and sign off on each control. During that process, reviewers will be presented with the statistics on test results by business units/ accounting processes, testing evidences collected, and any additional comments/ remediation/ suggestion provided by testers. Reviewers then make a final assertion on the control effectiveness. At that point, CERTRACK can pull out summary and detailed reports to automate SOX404 reporting, which will save users a lot of time and effort to prepare and organize that information by themselves.

Ready to see an online presentation of CERTRACK? Click here to book it at your convenience.