I'm curious — how many internal audit departments are still devoting time to U.S. Sarbanes-Oxley Act of 2002 testing? I'm guessing this is pretty routine by now. Testing starts by identifying the material accounts or processes, maybe even with a risk assumption for susceptibility to understatement (liabilities), theft (cash and receivables), or a high degree of estimation (inventory obsolescence, bad debt). The process is all very well documented, the templates are pretty, and there's nowhere near the drama of the early years, before the U.S. Public Company Accounting Oversight Board's Auditing Standard No. 5.
We seem to be in a good place now. There is more rigor around the testing processes, and company employees understand what is and is not a “Sarbanes-Oxley control.” Documentation is usually easy to update, and the testing happens without much hoopla. Currently, my department has no direct responsibility for Sarbanes-Oxley testing — that responsibility lies with a fully dedicated team that reports outside of my organization. Internal audit, in this case, periodically evaluates the Sarbanes-Oxley process for quality and effectiveness — much like what the external auditors used to do under the old rules. This structure has allowed my team to fully devote our time and attention to more traditional audit areas — including audits of systems, compliance, and operations — while still performing an appropriate number of financially focused audits.
But, no matter how you’re structured, let’s not forget the Sarbanes-Oxley testers who, while no longer in the spotlight, still perform important work in a diligent and professional manner. They still find ways to streamline, automate, and simplify their processes each year while not compromising the objectives. Whether in internal audit, performed as a self-assessment with or without external verification, or performed by dedicated Sarbanes-Oxley teams, these individuals still deserve a loud and boisterous round of applause and the thanks of those who rely on their work to certify to the accuracy of the financial statements.
For those of you who work at companies with Sarbanes-Oxley requirements — what percentage of time does your internal audit department devote to Sarbanes-Oxley testing or project management? What percentage of time would you like to devote to these efforts?
Posted on Jul 21, 2011 by Kiko Harvey
Share This Article: