would address these risks with sufficient precision determining which transaction-level controls would address these risks in the absence of precise entity-level controls determining the nature, extent, and timing of evidence gathered to complete the assessment of in-scope controls Management is required to document how it has interpreted and applied its TDRA to arrive at the scope of controls tested. In addition, the sufficiency of evidence required (i.e., the timing, nature, and extent of control testing) is based upon management (and the auditor's) TDRA. As such, TDRA has significant compliance cost implications for SOX404. Method The guidance is principles-based, providing significant flexibility in the TDRA approach. There are two major steps: 1) Determining the scope of controls to include in testing; and 2) Determining the nature, timing and extent of testing procedures to perform. Determining scope The key SEC principle related to establishing the scope of controls for testing may be stated as follows: "Focus on controls that adequately address the risk of material misstatement." This involves the following steps: Determine significance and misstatement risk for financial reporting elements (accounts and disclosures) Under the PCAOB AS 5 guidance, the auditor is required to determine whether an account is "significant" or not (i.e., yes or no), based on a series of risk factors related to the likelihood of financial statement error and magnitude (dollar value) of the account. Significant accounts and disclosures are in-scope for assessment, so management typically includes this information in its documentation and generally performs this analysis for review by the auditor. This documentation may be referred to in practice as the "significant account analysis." Accounts with large balances are generally presumed to be significant (i.e., in-scope) and require some type of testing. New under the SEC guidance is the concept of also rating each significant account for "misstatement risk" (low, medium, or high), based on similar factors used to determine significance. The misstatement risk ranking is a key factor used to determine the nature, timing, and extent of evidence to be obtained. As risk increases, the expected sufficiency of testing evidence accumulated for controls related to significant accounts increases (see section below regarding testing & evidence decisions). Both significance and misstatement risk are inherent risk concepts, meaning that conclusions regarding which accounts are in-scope are determined before considering the effectiveness of controls. Identify financial reporting objectives Objectives help set the context and boundaries in which risk assessment occurs.