Audit Scope

In 2002, the US Congress reacted to a series of accounting scandals by enacting the Sarbanes-Oxley Act (SOX) with the costly and burdensome Section 404 (S404). Initially, internal auditors dedicated most, if not all, of their resources toward meeting S404 requirements causing the internal audit pendulum to swing from a consulting focus to an assurance/compliance focus (Deloitte, 2006; Gray, 2004; PwC, 2005). While most internal auditors agreed that they should direct the internal control compliance effort, they found the work to be tedious and mundane (Nagy and Cenker, 2007). As such, many internal auditors sought ways to lessen their S404 compliance role and return to areas requiring more of their expertise and professional judgment.

Ten of the 11 CAEs reported that their S404 workload has significantly decreased since the early compliance years [1]. Time and resources dedicated to S404 compliance work for these ten internal audit departments declined from 90 to 100 percent in the initial compliance years to 20 to 50 percent in 2009. The CAEs noted more efficient testing and documenting procedures and the issuance of much needed guidance by the Public Company Accounting Oversight Board (PCAOB) as the primary reasons for the reduced S404 workload. In particular, Auditing Standard No. 5 issued by the PCAOB in 2007 persuaded external auditors and management to focus on key internal organizational control. One CAE stated that their company went from documenting and testing 3,900 controls in the early compliance years to a more reasonable 250 key controls in the current year. The remaining CAEs noted similar reductions in the number of controls tested and documented for the S404 requirement. This renewed focus on the key controls along with improved testing and documenting efficiencies has significantly reduced internal audit’s workload for S404 compliance.

Despite the reduction in S404 work, the sampled companies’ internal audit departments still dedicate significant time and resources (20 to 50 percent) toward S404 compliance, although the current roles of internal audit differ. Six of the sampled CAEs reported they have effectively shifted internal control documentation and testing responsibilities from internal audit to process owners. For these companies, internal audit simply coordinates and monitors compliance work performed by process owners. The remaining five internal audit departments still assume full compliance responsibility and perform all documentation and internal control testing annually. The CAEs do not expect their department’s S404 responsibilities to change in the near future.

Ten of the eleven sampled CAEs believe that annual S404 compliance requirement is still beneficial. They suggest the annual S404 exercise maintains a high level of awareness of internal control importance. Several CAEs also suggested that S404 work tightened their company’s internal control structure, particularly in information technology. Despite these benefits, the CAEs were quick to express many concerns about the ongoing compliance requirements. Six of the CAEs fear that S404 work is “losing its luster” and employees are beginning to view it as a ‘rubber-stamp’ exercise. Other CAEs questioned whether the compliance benefits exceed the costs. Nonetheless, they do not anticipate a reprieve from S404 requirements for their companies in the near future.

One CAE did not find any benefit in the annual S404 compliance work, suggesting the initial compliance efforts effectively identified and rectified material control weaknesses, and subsequent annual compliance efforts merely document and test already sound internal control structures. Furthermore, this CAE believes that the external auditors miss the spirit of the regulation by focusing on check marks or initials indicating control performance rather than business processes effectiveness