US internal audit focus moving off Sox, says survey

A new Protiviti survey says US internal audit departments are returning to their roots

CALIFORNIA – Internal audit departments have moved away from their recent preoccupation with the Sarbanes-Oxley (Sox) regulation since its implementation in 2002, according to a new study by risk and internal audit consultants Protiviti.

The survey shows that a quarter of tested firms have rebalanced their focus towards traditional business as usual and away from compliance efforts – up from one in 10 companies in the previous study in 2005.

The four-month study ran from the Institute of Internal Auditors’ October 2006 ‘All Star Conference’ until January 2007, analysing the first wave of companies reaching the turning point of three years of Sox compliance – when 80% of the firms polled achieved rebalancing.

Highlighting firms’ progress, Protiviti’s managing director and head of global internal audit practice Bob Hirth said: “This process of rebalancing is tied closely to the development of a more efficient and sustainable approach to compliance, which is why it takes time to achieve.”

“At the same time, as a result of Sarbanes-Oxley, there is definitely more financial reporting control-related auditing being conducted, and there is a heightened focus on IT auditing, both of which are positive outcomes of the legislation,” Hirth said.

The study focuses on the importance of longer-term rebalancing, rather than a narrow focus on financial reporting at the expense of traditionally core functions and operations.

The study found that 47% of internal auditors said the top benefit of rebalancing away from Sox was performing traditional audits, ahead of other benefits such as better risk coverage – which came out top in 2005.

Hirth said: “This is a strong indicator that after more than three years of Sarbanes-Oxley compliance, internal auditors are ready for – and recognise a need for – the internal audit function to get back to basics.”

The traditional elements consist of assisting management and the audit committee in directing enterprise risk management, identification of potential fraud indicators and focused audits of higher risk operations such as IT security, business continuity, remote locations, revenue processes, capital construction, and other non-Sox compliance.

The survey concluded that rebalancing strategies are in continuous evolution, with the most common being reducing the population of controls, the number of key controls, and reliance for internal audit on external auditors – which remains largely internal but the survey predicted as the next trend in rebalancing.

While the process is in flux, the study also found that once initiated, 45% of firms achieved rebalancing within one year, 28% managing in less, owing to a high degree of creativity in re-scoping workload, increasing process ownership and shifting resources, rather than adding resources less efficiently as before.