My thanks to Bob Hirth for sharing a copy of this survey. I remember his smile when he said that he knew I didn’t always agree with Protiviti’s views, and maybe he anticipated that my comments (in this blog) would not be entirely favorable. He would have been right.

I want to split my discussion of the survey into two pieces. The first is around the role of internal audit when it comes to SOX, and then I want to talk about the survey in general.

Internal audit and SOX

The Protiviti survey has a section headed: “Internal Audit Has Primary Responsibility for Sarbanes-Oxley Work”. But the content of the section has a key statement that uses different language: “The internal audit function remains the primary owner of oversight responsibilities regarding compliance efforts in most organizations, followed by the audit committee and executive management”. I don’t know about you, but I find this confusing.

1. Internal audit frequently is asked to perform tests of the SOX key controls. This is consistent with the heading, that internal audit has primary responsibility for the work.
2. Internal audit is rarely (in my experience) responsible for oversight of the SOX compliance work. Oversight is typically an audit committee activity, not even an executive management responsibility. It is true that internal audit may audit the SOX testing as part of its assurance services. But that is not oversight, which remains an audit committee responsibility.
3. The CAE often helps manage the program, with the scoping, the plan for testing, and the evaluation of any deficiencies. But management remains responsible for the system of internal controls over financial reporting. Internal audit may host a SOX program office (I did at a few companies) because of the opportunity to add value through our knowledge of internal controls, etc. But while this is fairly frequent, in my experience internal audit functions assist with testing far more often than running the SOX program.

So as the section is written, I am not sure what to make of it.

Maybe it means that internal audit is performing most of the testing. Certainly, that is what Francine McKenna understood when she commented on the survey in her fine blog, Re: The Auditors. She said: “The Protiviti report had a few surprises for me — well, maybe not — about who’s doing the work of Sarbanes-Oxley within companies. For the most part it’s still internal audit.”

Francine interviewed Richard Chambers for his opinion on internal audit performing SOX testing. She quotes him as saying:

“While nothing about that contravenes our professional standards, the best role for Internal Audit to play in Sarbanes-Oxley compliance initiatives is to provide overall assurance on the effectiveness of the organization’s documentation and testing of internal controls and Section 302 certification process, rather than to be down in the weeds doing the actual documentation and testing of controls instead of management.”

I disagree when it comes to SOX testing. Sorry, Richard.

If we can assume that internal audit will get the resources to perform both value-add SOX testing as a service to management and meet its obligation to the board to provide assurance and consulting internal audit services, then why shouldn’t internal audit do both? Is it because:

• It would be a violation of our independence as internal auditors? I don’t think so and Richard says it wouldn’t be contrary to IIA Standards.
• It prevents us from doing ‘regular’ internal auditing? It doesn’t if internal audit is able to get the necessary resources. If management is willing to resource a separate SOX testing team, then they have already demonstrated they could fund that within internal audit.
• It’s not a good use of internal auditors? Why not? The audit plan could combine SOX and other work in an area to obtain efficiencies. In addition, internal audit can not only identify a test failure, but make value-added recommendations for process and control improvement.

There are good reasons for having internal audit perform SOX testing:

• Cost efficiencies can be obtained.
• Internal audit can leverage their understanding to make value-add recommendations for process and control efficiencies.
• Administration and coordination is easier when it’s all in the same house.
• The CAE just understands this stuff – give it to the expert.

I recognize that some companies are large enough that it makes good business sense to set up a separate Internal Controls Compliance (or similar) function within Finance. But that doesn’t mean it’s best for every company.

So my answer to whether internal audit should perform the SOX testing is “it depends on what makes most sense for each company.” Sometimes, especially for smaller companies, it makes more sense to ask internal audit to perform the testing – as long as they are given the resources.

Richard mentions both testing and “SOX documentation”, which I assume to be documentation of the processes and controls. In my experience that is rarely done by internal audit and absolutely should be a management responsibility. I don’t see the value of internal audit doing it, and great value in requiring it be done by operating management.

The Rest of the Survey

Frankly, there are a lot of charts but not enough useful information for me in the report. For example, one key area for obtaining efficiency in management’s program is having the external auditor reduce fees by placing more reliance on management testing (whether performed by internal audit or another team). The chart (on page 27) seems to say that at 39% of companies, reliance is placed by the external auditors on internal audit testing of >75% of low risk key controls. But I am not sure I am reading the chart correctly.

Rather than continue to critique the survey for less than clear and useable information, I am going to use this post to ask questions for which I would like answers in the next Protiviti SOX survey.

1.       Key controls

a.       What is the average number of key controls for companies? (Mean, median, and how much do the numbers vary?)

b.      How does that vary by company size?

c.       How does that vary by industry?

d.      How does that vary depending on whether a single ERP is used?

e.      How does that vary when the majority of processes are performed by a shared service center?

f.        What are the trends?

g.       What percentage of key controls are automated controls? How many are hybrid? How many are at the entity-level (corporate vs. regional vs. division)? How many are IT general controls?

2.       Cost

a.       What is the average total SOX program?

b.      How does that vary by company size?

c.       How does that vary by industry?

d.      How does that vary depending on whether a single ERP is used?

e.      How does that vary when the majority of processes are performed by a shared service center?

f.        What are the trends?

g.       What percentage of the cost relates to the testing of automated controls?

h.      What percentage of the cost relates to the testing of IT general controls?

3.       Reliance by external auditors

a.       What is the average level of reliance (in terms of percentage of key controls)?

b.      How does that vary for low risk and high risk controls?

c.       How does that vary by company size?

d.      How does that vary by industry?

e.      How does that vary by type of control (manual vs. automated vs. IT general controls)?

f.        How does that vary by audit firm?

g.       How does that vary when internal audit does the work rather than management, rather than another independent testing group?

4.       Use of automation

a.       How much use is made of automation for:

                   i.      Program management, including scheduling, remediation management, and reporting.

             ii.      Process and control documentation.

             iii.      Documentation of testing.

             iv.      Surveys and self-assessments.

             v.      Automated testing of controls.

b.      How valuable are each of the above?

I am sure there are more questions to be asked. What do you want answered?