
US internal audit focus moving off Sox, says survey
Daily news headlines
CALIFORNIA – Internal audit departments have moved away from their recent preoccupation with the Sarbanes-Oxley (Sox) regulation since its implementation in 2002, according to a new study by risk and internal audit consultants Protiviti.
The survey shows that a quarter of tested firms have rebalanced their focus towards traditional business as usual and away from compliance efforts – up from one in 10 companies in the previous study in 2005.
The four-month study ran from the Institute of Internal Auditors’ October 2006 ‘All Star Conference’ until January 2007, analysing the first wave of companies reaching the turning point of three years of Sox compliance – when 80% of the firms polled achieved rebalancing.
Highlighting firms’ progress, Protiviti’s managing director and head of global internal audit practice Bob Hirth said: “This process of rebalancing is tied closely to the development of a more efficient and sustainable approach to compliance, which is why it takes time to achieve.”
“At the same time, as a result of Sarbanes-Oxley, there is definitely more financial reporting control-related auditing being conducted, and there is a heightened focus on IT auditing, both of which are positive outcomes of the legislation,” Hirth said.
The study focuses on the importance of longer-term rebalancing, rather than a narrow focus on financial reporting at the expense of traditionally core functions and operations.
The study found that 47% of internal auditors said the top benefit of rebalancing away from Sox was performing traditional audits, ahead of other benefits such as better risk coverage – which came out top in 2005.
Hirth said: “This is a strong indicator that after more than three years of Sarbanes-Oxley compliance, internal auditors are ready for – and recognise a need for – the internal audit function to get back to basics.”
The traditional elements consist of assisting management and the audit committee in directing enterprise risk management, identification of potential fraud indicators and focused audits of higher risk operations such as IT security, business continuity, remote locations, revenue processes, capital construction, and other non-Sox compliance.
The survey concluded that rebalancing strategies are in continuous evolution, with the most common being reducing the population of controls, the number of key controls, and reliance for internal audit on external auditors – which remains largely internal but the survey predicted as the next trend in rebalancing.
While the process is in flux, the study also found that once initiated, 45% of firms achieved rebalancing within one year, 28% managing in less, owing to a high degree of creativity in re-scoping workload, increasing process ownership and shifting resources, rather than adding resources less efficiently as before.
Only users who have a paid subscription or are part of a corporate subscription are able to print or copy content.
To access these options, along with all other subscription benefits, please contact info@risk.net or view our subscription options here: http://subscriptions.risk.net/subscribe
You are currently unable to print this content. Please contact info@risk.net to find out more.
You are currently unable to copy this content. Please contact info@risk.net to find out more.
Copyright Infopro Digital Limited. All rights reserved.
You may share this content using our article tools. Printing this content is for the sole use of the Authorised User (named subscriber), as outlined in our terms and conditions - https://www.infopro-insight.com/terms-conditions/insight-subscriptions/
If you would like to purchase additional rights please email info@risk.net
Copyright Infopro Digital Limited. All rights reserved.
You may share this content using our article tools. Copying this content is for the sole use of the Authorised User (named subscriber), as outlined in our terms and conditions - https://www.infopro-insight.com/terms-conditions/insight-subscriptions/
If you would like to purchase additional rights please email info@risk.net
More on Operational risk
Power play: how geopolitics is shaping op risk at G-Sibs
Op Risk Benchmarking: Geopolitics is a top five fear for G-Sibs, but most banks lack specialist risk staff and classical tools
Automating regulatory compliance and reporting
Flaws in the regulation of the banking sector have been addressed initially by Basel III, implemented last year. Financial institutions can comply with capital and liquidity requirements in a natively integrated yet modular environment by utilising…
No tick-the-box approach to compliance risks
Op Risk Benchmarking: G-Sibs share fear of regulatory run-ins, but lack common stance on modelling, KRIs and more
Bread-and-butter op risks at the top table
Op Risk Benchmarking: As G-Sibs are forced to do more, how can they avoid doing more wrong?
Op Risk Benchmarking: Inside the G-Sibs
New initiative scrutinises op risk measurement and management practices at the world’s largest banks
Sizing cyber: banks split on who owns and measures hack threats
Op Risk Benchmarking: G-Sibs split on risk modelling and management for IT disruption and infosec
Banks frequently breach appetite for top op risks
Op Risk Benchmarking: Five G-Sibs breached appetite in past year across four risk types, new research reveals
Investment banks: the future of risk control
This Risk.net survey report explores the current state of risk controls in investment banks, the challenges of effective engagement across the three lines of defence, and the opportunity to develop a more dynamic approach to first-line risk control