Sarbanes-Oxley

Sarbanes-Oxley Act Section 301

Requires the Audit Committee to:
Directly oversee the Companys external audit firm. Be independent. Establish procedures for handling complaints about accounting or auditing matters. Have authority to hire advisors. Be adequately funded.

Specific issues to be defined in Audit Committee Charter

Purpose Authority Financial Statements External Audit - Internal Control - Reporting - Composition - Compliance

Sarbanes-Oxley Act Section 302

Requires CEOs and CFOs to personally certify in Quarterly Financial Reports that they:
Know of no material financial misstatements. Designed internal controls to discover misstatements. Evaluated internal controls within last 90 days. Presented their conclusions about effectiveness of internal controls. Disclosed to external auditors and Audit Committee:
Any significant deficiencies or material weaknesses in design or operation of internal controls. Any fraud involving people who have a significant role in internal controls.

Indicated in their report whether any significant changes in internal controls have occurred since their evaluation.

Sarbanes-Oxley Act Section 302 - Tools

Implementation Guide Disclosure Committee Charter Control Assessment Survey
Internal Audits role:
Advising on creation and modification of processes supporting certifications. Evaluating the overall disclosure process. CAEs issuing opinion on internal controls over Financial reporting annually. Using COSO internal control framework as criteria for evaluation. Increasing audit effort on Financial reporting. Coordinating with external auditors.

Sarbanes-Oxley Act Section 404

PCAOB: Auditing Standard No. 2
Paragraph 24
Controls related to the prevention and detection of fraud often have a pervasive effect on the risk of fraud Such controls include the adequacy of the internal audit activity and whether the internal audit function reports directly to the audit committee, as well as the extent of the audit committee's involvement and interaction with internal audit

Sarbanes-Oxley Act Section 404

PCAOB: Auditing Standard No. 2, continued
Paragraph 121
Internal auditors normally are expected to have greater competence with regard to internal control over financial reporting and objectivity than other company personnel

The external auditor may be able to use their work to a greater extent than the work of other company personnel - this is particularly true in the case of internal auditors who follow the International Standards for the Professional Practice of Internal Auditing issued by the IIA

Sarbanes-Oxley Act Section 404

Implementation Steps
Assign responsibility for process design and oversight. Integrate section 302 and 404 evaluation process. Coordinate with external auditor. Select a control model. Decide on scope of Internal control evaluation. Utilize Self-Assessment. Build on existing controls. Identify gaps. Conduct the evaluations.

Internal Audit should be CEO and CFOs best source of assurance about internal control