When the Sarbanes-Oxley Act went into effect in 2002, internal auditors were often part of their organizations' compliance efforts. In the initial year(s) of compliance, the intensity of Sarbanes-Oxley preparations challenged many internal audit (IA) functions’ ability to complete their original plans and regular work. In 2005, Protiviti conducted a survey to determine whether and how IA functions would “rebalance” their activities to address risks overshadowed by the intense focus on financial reporting. With the release of the second edition in 2007 and the third in 2008, this survey series follows the evolution of internal audit’s “rebalancing” in the years following Sarbanes-Oxley.

Fourth Edition (2009)
Third Edition (2008)
Second Edition (2007)
First Edition (2005)

Fourth Edition

In the 2009 survey, one of the more interesting trends emerging from the analysis of the data is an apparent drop among organizations in activities and perceived benefits relating to the SEC's interpretive guidance to management on implementing Section 404 of Sarbanes-Oxley and the PCAOB's Auditing Standard No. 5 (AS5). Both were designed to ease compliance burdens among companies and facilitate a more efficient and streamlined attestation by external auditors of internal control over financial reporting. There could be several reasons behind this trend. Certainly there is a heightened regulatory environment in the wake of the many well-publicized bank and corporate failures worldwide. There also could be a general aura of "compliance conservatism" because of the global financial crisis that is impacting virtually every organization around the world. It also could be that the rate of changes being implemented by companies has slowed since it has now been two years since the SEC’s and PCAOB’s announcements. Protiviti explores these and other themes further throughout this report.

Other key findings include:  

1. "Internal audit being able to perform more traditional audits" and "more appropriate coverage of risk" rank as the top benefits of rebalancing.
2. "Reduced Section 404 and 302 compliance costs" is the third-highest ranked benefit, yet the response was down 7 percent from 2008.
3. There was a year-over-year increase in the number of organizations identifying themselves as in either the "first year" or "pre-first year" of compliance. This is the result of the pending deadline for smaller companies to comply with the auditor attestation requirement of Section 404 (beginning for fiscal years ending on or after December 15, 2009).
4. Nearly three out of four organizations have achieved or moved beyond rebalancing, or have rebalancing under way or in the planning stages.
5. Risk-based testing and rescoping workloads are the top rebalancing activities.

Download Moving Internal Audit Back into Balance: A Post-Sarbanes-Oxley Survey, Fourth Edition  (PDF) (requires Acrobat Reader; please disable your pop up blocker) 

Third Edition

Significant strides toward rebalancing continue to be made, as evidenced by the results from Protiviti’s third Rebalancing survey that was conducted in January and February 2008. A total of 321 respondents - two-thirds of which are either Chief Audit Executives (CAEs) or Audit Directors - indicated that the landscape again has changed considerably since the previous study, thanks to the SEC’s May 2007 interpretive guidance to management on implementing Section 404 of the Sarbanes-Oxley Act and the passage of the PCAOB’s Auditing Standard No. 5 (AS5) in July 2007. Though many of the study’s results are similar to the 2006/2007 survey - including the number of companies that have achieved rebalancing (22 percent) - clear trends emerge that show internal audit functions employing more defined and sophisticated strategies to achieve rebalancing, due in part to the SEC’s and PCAOB’s guidance.

1. "Internal audit being able to perform more traditional audits" ranks as the top benefit of rebalancing. Also cited frequently was "more appropriate coverage of risk."
2. Of those surveyed, more than half - 57 percent - are either in or beyond their fourth year of compliance, 32 percent of which report they have achieved rebalancing.
3. Approximately one in five companies report having achieved rebalancing this year, and half of that number achieved rebalancing one year ago, which is comparable to last year's results. These findings underscore the point that for most organizations, rebalancing continues to be a work in progress that requires adjustment as the business and regulatory landscapes change.
4. Companies reported that efforts to reduce the total population of controls, as well as the number of key controls, significantly exceeded what was planned last year (as reported in the 2007 rebalancing survey). This is a key indicator that the PCAOB's AS5 and the SEC's interpretive guidance are having the impact that was intended.

Download Moving Internal Audit Back into Balance: A Post-Sarbanes-Oxley Survey, Third Edition  (PDF) (requires Acrobat Reader; please disable your pop up blocker)

Second Edition

In the first edition of Moving Internal Audit Back into Balance, the majority of respondents indicated a rebalancing initiative was underway or in the planning stages.

So, where are we now? How have IA professionals adapted to the increased responsibilities and workload demanded by the internal control over financial reporting requirements of Sarbanes-Oxley? Is there progress toward rebalancing, and what strategies are being pursued to make it happen?

In order to answer questions such as these, from October 2006 to January 2007, Protiviti conducted its second annual survey among 311 internal audit professionals to see what progress has been made toward rebalancing.  Respondents shared their plans, progress and experiences regarding their efforts to rebalance IA activities.

Survey findings include:

1. 25 percent of survey respondents report having “achieved rebalancing” - more than double from one year ago.
2. Of those having achieved rebalancing, almost 80 percent are in their third year of compliance. Once organizations refine their Sarbanes-Oxley compliance activities, and officially set out on the road to rebalancing, significant progress can be made quickly.
3. 95 percent of survey respondents said they achieved rebalancing within two years of beginning the effort.

Download Moving Internal Audit Back into Balance: A Post-Sarbanes-Oxley Survey, Second Edition  (PDF) (requires Acrobat Reader; please disable your pop up blocker)

First Edition

In Q3 2005, Protiviti conducted a survey among internal audit professionals, including chief audit executives and internal audit directors, to assess how companies are approaching the process of "rebalancing" internal audit functions after first-year Sarbanes-Oxley compliance projects. This report details the results of the study and identifies the past and future roles of internal audit departments in regulatory compliance efforts.

Among the survey's key findings:

1. Most internal audit functions see the need to rebalance.
2. Rebalancing will be a perpetual activity, with fewer hours devoted to Sarbanes-Oxley compliance in Year Two and beyond.
3. In the effort to rebalance, many functions will add resources and increase internal audit budgets.
4. Many companies will look for outside assistance with their rebalancing efforts.
5. Internal audit will continue to play a key role in Sarbanes-Oxley compliance, though internal control documentation efforts will decrease.
6. The audit committee will play an oversight role in the rebalancing effort.
7. Rebalancing will provide many benefits, the largest of which will be a more appropriate focus on risk.

Download Moving Internal Audit Back into Balance: A Post-Sarbanes-Oxley Survey (PDF) (requires Acrobat Reader; please disable your pop up blocker)it doe