MENLO PARK, Calif. – July 31, 2009 – Amid a global financial crisis and changing marketplace that have affected virtually every business worldwide, organizations must identify and understand new and emerging risks they face. For internal auditors, this means spending a greater portion of their time on risk management responsibilities as well as compliance efforts. Too often in recent years, internal audit departments, which play a key role in helping management and boards with risk management, have focused predominantly on Sarbanes-Oxley compliance.  

Protiviti Inc., a global business consulting and internal audit firm, delves into this balancing act as well as other issues in the just-released fourth edition of its study:  Moving Internal Audit Back Into Balance: A Post-Sarbanes-Oxley Survey. More than 600 respondents – a majority of whom are chief audit executives, audit directors or audit managers – took part in the 2009 survey, answering questions in two categories:  “Rebalancing Strategy” and “Internal Audit Organization and Focus.”  

“Over the past few years, as organizations gained expertise in Sarbanes-Oxley compliance and learned how to streamline their efforts, we’ve witnessed the role of internal audit evolve,” said Bob Hirth, executive vice president of the Global Internal Audit practice at Protiviti. “This year’s survey reveals a prevailing mindset:  Despite ongoing Sarbanes-Oxley compliance requirements, rebalancing the internal audit department is a top priority. Respondents recognized that a balanced, effective internal audit department can contribute so much more in terms of helping management and the board identify, manage, mitigate and monitor key risks.”  

Approximately half of participants surveyed reported that the SEC’s 2007 guidance on Sarbanes-Oxley Section 404 implementation and the PCAOB’s 2007 Auditing Standard No. 5 (AS5) have enabled them to increase rebalancing efforts and reduce hours for external auditors and other resources. This response was noticeably lower compared to Protiviti’s 2008 survey results. Hirth offers a number of possible reasons for the decline, including:  

1. Management’s desire to maintain the status quo as long as the organization is already in compliance.
2. Ongoing trial and error, with organizations still determining where and how to reduce the scope of controls and activities throughout their organizations.
3. Companies have already made necessary adjustments and are not making further reductions or changes in their Sarbanes-Oxley compliance processes.
4. The “smaller public company factor,” as these businesses have ‑ up to this point ‑ been exempt from complying with the auditor attestation requirement of Section 404 (they must comply beginning with fiscal years ending on or after December 15, 2009). Of note, 7 percent of respondents were from companies that reported annual revenues of less than $100 million.
5. A need for more education about the SEC’s guidance and PCAOB AS5.  

Other key findings from this year’s Rebalancing Survey include:

1. Nearly three out of four organizations have achieved or moved beyond rebalancing, or have rebalancing underway or in the planning stages – consistent with results from the 2008 and 2007 Rebalancing Surveys.
2. Risk-based testing (66 percent) and re-scoping workloads (65 percent) are the top rebalancing activities; on the flip side, just one in five respondents cited “add additional resources” this year, which peaked in 2005 at 62 percent.
3. “Internal audit being able to perform more traditional audits” and “more appropriate coverage of risk” ranked as the top rebalancing benefits, at 36 percent and 29 percent respectively. “Reduced Section 404 and 302 compliance costs” is the third-highest ranked benefit (12 percent), yet the response was down 7 percent from 2008. 

Most survey respondents (60 percent) were in or beyond their fourth year of Sarbanes-Oxley compliance, generally mirroring the compliance timeline since the Act went into effect for large accelerated filers.  

Protiviti launched its rebalancing study in 2005 to assess how organizations rely on their internal audit departments for Sarbanes-Oxley compliance-related activities while seeking to “rebalance” these functions to also address more traditional internal audit responsibilities. This year’s survey was conducted from October to December 2008, garnering responses from online participants and attendees at The Institute of Internal Auditors All-Star Conference. For a complimentary copy of Moving Internal Audit Back Into Balance: A Post-Sarbanes-Oxley Survey, visit http://www.protiviti.com/go/rebalancingsurvey.