Possible missteps

Internal Auditor, Feb, 2005 by Daniel Abrams

Complying with Section 404 of the U.S. Sarbanes-Oxley Act of 2002 was a priority for many organizations in 2004. Kristina Kendall's article, "A 10-Step Sarbanes-Oxley Solution" (December 2004), is an excellent example of what a majority of organizations have chosen to do--reallocate available internal audit resources to achieve compliance. While I agree that Kendall and her audit group have performed exactly what they were instructed to do in a manner that exhibits professionalism and competence, the intent of the legislation was to place the burden of compliance on the owners of the controls and processes, not an organization's internal audit function.

[ILLUSTRATION OMITTED]

It is readily agreed that most of the financial risks normally assessed by an organization's internal audit group will be rigorously evaluated by whomever is charged with achieving compliance. This is a definite benefit to the organization. However, when internal auditors perform the work, two major failures occur. The first relates to financial management's loss of the opportunity to understand their controls in a manner that goes much deeper than mere performance or use. By offloading the detail work to the control-risk experts, they have effectively negated one of the primary thrusts of the legislation. In addition, while internal auditing has been applying its skill sets and resources toward compliance, many audit plans or portions of audit plans have simply been shelved until further notice. This makes management happy as they have successfully avoided being audited, but it means that every risk outside of a compliance scope has been left to the integrity and capability of management.

Audit committees have readily reallocated internal audit resources to mitigate the costs associated with compliance. Their organizations have been spared an additional line item against revenue. There is a very real risk that these savings will be offset by an extraordinary rise in the costs associated with poor process management and execution in business areas outside the scope of the legislation.

DANIEL ABRAMS, CPA, CISA

Project Lead IT Audit

TNMP

Fort Worth, Texas

dabrams@tnpe.com