Streamlining auditor attestation

Internal Auditor, June, 2008 by Ilan Haimoff

WHILE SOME MEMBERS OF OUR PROFESSION MAY DEBATE THE APPROPRIATE level of internal audit involvement with U.S. Sarbanes-Oxley Act of 2002 compliance, most would likely agree that our assessment of Sarbanes-Oxley programs and key financial controls is critical to organizational stakeholders. Our extensive knowledge and unique perspective on business risk and control processes adds considerable value to compliance efforts. In fact, the importance of internal auditing's role in these and other processes merits its requirement by regulators. While the New York Stock Exchange has already established this requirement for its listed companies, a comparable mandate should be put in place for all publicly listed firms. Requiring all such companies to maintain an internal audit function would not only ensure added value for stakeholders, but it would also lead to efficiencies in the external audit process. Internal auditing's guaranteed presence in the organization would provide the foundation needed for independent auditors to streamline their attestations of internal controls over financial reporting, thereby providing considerable savings for U.S.-listed firms.

[ILLUSTRATION OMITTED]

Sarbanes-Oxley requires independent auditors to attest to management's assessment of controls over financial reporting. However, the U.S. Public Company Accounting Oversight Board (PCAOB), which oversees external auditors of public companies, far exceeds this mandate by requiring external auditors of large publicly listed companies to express an opinion on the effectiveness of internal control over financial reporting, not just on management's assessment. Interestingly, the PCAOB's Auditing Standard No. 5 adopting release notes, "Some commenters have expressed their belief that the act requires only that the auditor review management's assessment process and not the company's internal control."

In contrast to the PCAOB, Japan's equivalent to Sarbanes-Oxley requires the independent auditor to attest to management's assessment only. The requirement emphasizes management's accountability for its internal control system and provides a clear scope for the auditor's attestation. U.S. regulators could adopt a similar approach, whereby independent auditors would attest to a tangible set of documentation provided by management. Internal auditing's presence in all publicly listed firms, however, would be essential to the success of this process. Through its monitoring of Sarbanes-Oxley compliance, internal auditing would strengthen the company's overall control environment and provide a more sound basis for the independent auditors to render their attestation. Internal audit functions, therefore, would need to be mandatory in all publicly listed firms and required to provide an independent assessment of the underlying documentation from management's assessment of financial controls.

Streamlining attestation would better align the independent auditor's role with the Sarbanes-Oxley Act, and it would benefit both public companies and their investors. Moreover, it would give internal auditors increased recognition by the investing public for their value-added contributions to the organization.

To comment on this essay, e-mail the author at ilan.haimoff@theiia.org. The opinions expressed are solely those of the author.

Ilan Haimoff, CPA, CIA, CFE