affect the evidence considerations above include: Overall strength of entity-level controls, particularly the control environment: Strong entity-level controls act as a pervasive "counter-weight" to risk across the board, reducing the sufficiency of evidence required in lower-risk areas and supporting the spirit of the new guidance in terms of reducing overall effort. Cumulative knowledge from prior assessments regarding particular controls: If particular processes and controls have a history of working effectively, the extent of evidence required in lower-risk areas can be reduced. Consider risk, objectivity, and competence in testing decisions Management has significant discretion in who performs its testing. The SEC guidance indicates that the objectivity of the person testing a given control should increase proportionally to the ICFR risk related to that control. Therefore, techniques such as self-assessment are appropriate for lower-risk areas, while internal auditors (or the equivalent) generally should test higher-risk areas. An intermediate technique in practice is "quality assurance," where manager A tests manager B's work, and vice versa. The external auditors ability to rely on management's testing follows similar logic. Reliance is proportional to the competence and objectivity of the management person that completed the testing, also in the context of risk. For the highest risk areas, such as the control environment and period-end reporting process, internal auditors or compliance teams are likely the best choices to perform testing, if a significant degree of reliance is expected from the external auditor. The ability of the external auditor to rely on management's assessment is a major cost factor in compliance. Strategies for efficient SOX 404 assessment There are a variety of specific opportunities to make the SOX 404 assessment as efficient as possible. Some are more long-term in nature (such as centralization and automation of processing) while others can be readily implemented. Frequent interaction between management and the external auditor is essential to determining which efficiency strategies will be effective in each company's particular circumstances and the extent to which control scope reduction is appropriate. Centralization and automation Centralize: Using a shared service model in key risk areas enables multiple locations to be treated as one for testing purposes. Shared service models are typically used for payroll and accounts payable processes, but can be applied to many types of transaction processing. According to a recent survey by Finance Executives International, decentralized companies had dramatically higher SOX compliance costs than centralized companies. Automate and benchmark: Key fully automated