More than three years after the passage of the Sarbanes-Oxley, members of the business community have shifted their focus toward balancing SOX activities with other business priorities. Internal audit has been one of the areas in which companies have sounded the call for getting back to basics. That’s because internal audit led the Year One 404 compliance effort at most companies, which proved to be a Herculean task—often accomplished at the expense of the function’s other duties.
But while few would argue against the need to take a step back and refocus in Year Two, companies are varied in how they plan to approach the effort to put internal audit back in balance. That’s according to a report released this month by Protiviti, a provider of independent internal audit and business and technology risk consulting services, which found that almost three-quarters of internal audit professionals said rebalancing initiatives at their companies are either underway or in the planning stages.
Hirth
Going forward, “Companies will continue to spread the cost of SOX throughout the organization by shifting it down to the process owners, creating a separate risk and controls function and hiring outside resources to free up internal audit,” said Robert Hirth, head of Protiviti’s internal audit practice and a managing director in the company’s San Francisco office.
“Because no one ideally wanted to report they had a material weakness in their internal control structures, many internal audit departments took it upon themselves to focus intensely on assessing the risks and related controls over financial reporting—the core concern of Section 404,” according to the report, Moving Internal Audit Back into Balance (see box above, right). “Internal auditors responded promptly to educate their management and audit committees on the new internal control reporting requirements, and to assist their organizations in scoping these projects, providing guidance, and, in many cases, going beyond what some might think to be the normal role of internal audit.”
“But has this focus on SOX compliance occurred at the expense of addressing other important business risks? The answer is ‘probably,’” says to the report. “When Sarbanes-Oxley was enacted in July 2002, companies and, in turn, internal audit departments became highly focused and, in some cases, singularly focused on helping their organizations establish, design and test internal controls over financial reporting as required by SOX,” Protiviti concluded. “But in the process, internal audit may have gone too far. Attention and resources were diverted from other essential risk management areas in the organization.”
That sentiment was echoed in a recent report by Deloitte & Touche. That report, “Optimizing the Role of Internal Audit in the Sarbanes-Oxley Era,” also concluded that, with internal audit expected to continue to play a critical part in ongoing compliance efforts, companies may need to re-consider how their IA departments function within their organizations (see Optimizing Internal Audit In The Post-SOX Era, in box above right).
Getting Out Of The SOX Business
The Protiviti report, based on a survey of 140 internal audit professionals—83 percent of whom are from public companies—is focused on companies’ plans to “rebalance” their internal audit activities. Nearly three-quarters of respondents said rebalancing initiatives at their companies are either underway or in the planning stages. Half of the group said rebalancing efforts are in progress, 24 percent said they’re in the planning stages, while 13 percent said they haven’t started. Another 13 percent said they’re either not planning to rebalance or felt rebalancing isn’t needed. Those responses were eliminated for the rest of the questions.
As one respondent, a chief audit executive in the kitchenware manufacturing industry, summed it up: “We are very anxious to get back to basics and out of the SOX business.”
“Nearly everybody agrees with the idea of getting back to balance,” said Hirth. “The hard part is doing something about it.”
“Internal audit played a really important role in 404 compliance,” said Hirth, noting that, in order for internal audit to spend more time focusing on areas outside of financial reporting, “someone else has to fill that gap.”
QUOTES FROM THE SURVEY
“Our hope is to get internal audit
back into its completely independent
role. We have remained independent
through the process, but it
has been a challenge at times.”
—
CAE, manufacturing industry
“We have identified who can do the
work and in some cases we already
have those parties working.”
—
Audit manager, home building industry
“We avoided most SOX work and
stayed on track, so there is no need
to rebalance for SOX, just for normal
business issues.”
—
CAE, financial industry
“The internal audit function was
only established as the ‘SOX solution.’
There was never any other
‘use’ for an audit function.”
—
Manufacturing industry
“There have been discussions surrounding
the need to develop a
broader view of risk management,
but to date no actions are planned
or have been taken.”
—
Director of compliance, financial consulting
industry
“In Year One, the line did the testing,
and Controllers QA'ed 100%.
Audit did normal samples for each
control.”
—
CAE, banking industry
“We are very anxious to get back to
basics and out of the SOX business.”
—
CAE, kitchenware manufacturing
industry
“The audit committee is aware and
has asked for periodic updates, but
they have no direct involvement in
the process.”
—
CAE, building materials
manufacturing industry
“The audit committee is involved
only to the extent that they want to
see SOX costs reduced this year.”
—
Audit manager, banking industry
“Our external auditors are very supportive
of this rebalancing trend.”
—
CAE, retail industry
“Internal audit needs to get back to
a more defined role. Too much time
is being spent on SOX.”
—
CAE, mining
and processing industry
“[Benefits we expect include] extensive
process mapping, new risk/control
awareness among management
and the formal documentation of the
system of internal controls.”
—
CAE,
energy industry
“The benefit will be making sure the
[process] manager retains accountability
for internal controls.”
—
CAE,
stationery industry
“We will get back to operational
auditing, which has far more payback
in our company than SOX
work.”
—
CAE, battery manufacturing
industry
“We are awaiting final details from
our external auditor concerning the
extent to which they can rely upon
the company's work based upon
who performs it.”
—
Audit manager,
home building industry
“For the company, [the primary benefit
of rebalancing] is to reduce costs,
but for the IA department it's just a
relief.”
—
Audit manager, banking
industry
“Once we get everything figured out
we will, eventually, benefit.”
—
Audit
manager, communications industry
“I'm not sure. Our involvement last
year validating all assessments, I
believe, helped keep the quality of
the assessments higher than they
would have been otherwise. This
year we are validating fewer assessments.
That will result in reduced
SOX costs but may negatively impact
other areas.”
—
Audit manager, banking
industry
Source:
Protiviti's Moving Internal Audit Back Into Balance: A Post-SOX Survey
Interestingly, many internal audit professionals, who in most cases championed the 404 efforts at their companies, also expect to champion the effort to rebalance their department, according to the survey results. Most of the internal audit professionals surveyed (68 percent) said they expect their department’s involvement in the rebalancing process to be “significant,” 22 percent expect it to be “moderate” and 8 percent say it will be “minimal.” Meanwhile, 31 percent of respondents said management’s role in the rebalancing effort will be significant, 22 percent say the audit committee will play a significant role, and 21 percent say executive management’s involvement will be significant.
The internal audit professionals surveyed by Protiviti were optimistic about the value to their company of their planned rebalancing efforts. A third (33 percent) expect their company to benefit significantly, while 48 percent expect their company to moderately benefit. Eight percent expect the benefit to be minimal, while 6 percent expect things to stay the same, and 5 percent didn’t answer.
Varied Approaches
So, what do they expect to gain from their efforts? Most respondents (29 percent) said more appropriate coverage of risk will be the primary benefit of their rebalancing effort. The next most popular benefits cited were reducing Section 404 and 302 compliance costs and allowing internal audit to perform more traditional audits (18 percent each), followed by an increase in effectiveness and efficiency of operations (13 percent). Twelve percent said the primary benefit of rebalancing IA would be increased objectivity, while 3 percent said it would be increased reliance by external auditors on IA work, and 7 percent cited other.
The survey also showed that companies are taking numerous—and varied—approaches to rebalancing their internal audit function. The majority of companies (62 percent) said they will add additional resources, while 47 percent plan to reallocate their existing resources, and 41 percent say they will re-scope the workload. The same number said they will conduct and enterprise-wide risk assessment. Thirty-eight percent plan to conduct a self assessment and audit for process owners, while 30 percent will use third parties to assist in rebalancing, and 26 percent said they’ll create a separate function for Section 404 work.
“It’s easy for people to say they’re going to add more resources. But the devil is in the details,” said Hirth. However, he noted, “If ever there was a time internal audit can increase its budget, it’s during this era we’re in.”
Indeed, a combined 65 percent of those polled said their internal audit budget will increase this year. More than a quarter (27 percent) expect their budget to increase by 10 to 25 percent, while 20 percent expect an increase of less than 10 percent, and 18 percent expect an increase of more than 25 percent. Twelve percent of respondents expect their IA budget dollars to decrease this year.
Respondents were split on their reliance on outside resources going forward. Thirty-eight percent said their company’s internal audit department’s use of outside resources will increase due to their rebalancing effort, while 29 percent said it would decrease, and another 29 percent said it wouldn’t change.
Many internal audit professionals expect their primary role in their company’s Year Two SOX efforts to change. When asked about their primary roles in Year One, 63 percent cited evaluating design and testing operating effectiveness, while only 49 say that will be a primary responsibility in Year 2. Similarly, 59 percent said they had the lead responsibility for Year one SOX efforts, but just 46 expect that to stay the same for Year Two. And while 59 percent said they were a member of the compliance team or steering committee in Year One, only 19 percent expect to play the same role going forward.
Planning, which occupied the attention of most internal audit departments involved in SOX compliance in Year One, falls to fifth in importance in Year Two. Control design evaluation and documentation, which were key In the first year, are still considered important in Year Two. However, monitoring, year-end update testing and operational effectiveness testing were mentioned most often as priorities as IA departments tackle their second year of SOX compliance. Internal auditors expect the largest drop in effort between Year One and Year Two in the area of documentation development.
Meanwhile, according to the survey results, those who spent the most time on SOX in Year One don’t expect to repeat that effort in Year Two. While 38 percent of respondents said they dedicated more than three-quarters of internal audit department hours to SOX efforts during Year One, that number falls to only 7 percent expecting that amount for Year Two and 3 percent for Post-Year Two. The largest numbers of respondents plan to dedicate 20-50 percent of their IA hours to SOX efforts in Year Two (35 percent) and beyond (43 percent). The number of respondents (23 percent) who said they expended 50-75 percent of their workforce on SOX in Year One indicate they will maintain that same allocation in Year Two, though only 9 percent plan to do so after Year Two.
No comments yet