When the Sarbanes-Oxley Act went into effect in 2002, internal auditors were often part of their organizations' compliance efforts. In the initial year(s) of compliance, the intensity of Sarbanes-Oxley preparations challenged many internal audit (IA) functions’ ability to complete their original plans and regular work. In 2005, Protiviti conducted a survey to determine whether and how IA functions would “rebalance” their activities to address risks overshadowed by the intense focus on financial reporting. With the release of the fourth edition in 2009, this survey series continues to follow the evolution of internal audit’s “rebalancing” in the years following Sarbanes-Oxley.
In the 2009 survey, one of the more interesting trends emerging from the analysis of the data is an apparent drop among organizations in activities and perceived benefits relating to the SEC's interpretive guidance to management on implementing Section 404 of Sarbanes-Oxley and the PCAOB's Auditing Standard No. 5 (AS5). Both were designed to ease compliance burdens among companies and facilitate a more efficient and streamlined attestation by external auditors of internal control over financial reporting. There could be several reasons behind this trend. Certainly there is a heightened regulatory environment in the wake of the many well-publicized bank and corporate failures worldwide. There also could be a general aura of "compliance conservatism" because of the global financial crisis that is impacting virtually every organization around the world. It also could be that the rate of changes being implemented by companies has slowed since it has now been two years since the SEC’s and PCAOB’s announcements. Protiviti explores these and other themes further throughout this report.
Other key findings include:
- "Internal audit being able to perform more traditional audits" and "more appropriate coverage of risk" rank as the top benefits of rebalancing.
- "Reduced Section 404 and 302 compliance costs" is the third-highest ranked benefit, yet the response was down 7 percent from 2008.
- There was a year-over-year increase in the number of organizations identifying themselves as in either the "first year" or "pre-first year" of compliance. This is the result of the pending deadline for smaller companies to comply with the auditor attestation requirement of Section 404 (beginning for fiscal years ending on or after December 15, 2009).
- Nearly three out of four organizations have achieved or moved beyond rebalancing, or have rebalancing under way or in the planning stages.
- Risk-based testing and rescoping workloads are the top rebalancing activities.
Download Moving Internal Audit Back into Balance: A Post-Sarbanes-Oxley Survey, Fourth Edition (PDF) (requires Acrobat Reader; please disable your pop up blocker)