How Section 404 can help deter fraud: more than simply an exercise in compliance, Sarbanes-Oxley's section on internal controls can be a good starting point for reinvigorating measures to identify and halt manipulation of financial reporting and asset misappropriation.

• Author: Martin, Alyssa G.
• Position: Fraud

The Sarbanes-Oxley Act of 2002's mandate for authoritative documentation is expected to enhance a company's internal control structure to add prevention--not just detection--of fraud. Within the regulations are management's requirements to identify schemes and scenarios that could invite fraud. By establishing checks and balances in internal controls--regardless of technical or resource restrictions--fraud can be halted early instead of running unnoticed for months, as has been common.

[ILLUSTRATION OMITTED]

As financial executives know well, Sarbanes-Oxley Section 404 calls for documented proof that a company has an adequate internal control structure and procedures for financial reporting, as well as assessment of the effectiveness of these same areas. This means that company management must accept full responsibility for internal controls, and those controls must also pass the scrutiny of external auditors.

Furthermore, in the process of confirming internal control effectiveness, management can and should increase antifraud efforts to identify and halt manipulation of financial reporting and asset misappropriation, since the most common incarnations of fraud in today's companies are "inside jobs." It's a worthy next step.

New responsibilities for external auditors also help guard against fraud. In addition to inquiring about how management prevents fraud as prescribed by the Auditing Standards Board's Statement on Auditing Standards (SAS) No. 99, today auditors must actually attest to the effectiveness of the internal control structure. The auditing industry is also working to enhance the Committee of Sponsoring Organizations (COSO) framework to include fraud elements.

More Questions than Answers

The word "fraud" appears nowhere in Sarbanes-Oxley's brief Section 404 paragraph ("Management Assessment of Internal Controls"). Fraud is getting much more focus in companies today, however, because of the increasing and stringent expectation that internal controls should be structured precisely to avoid or detect fraud. The standard issued to provide guidance for Section 404 does give a cursory elaboration on fraud, but still generates as many questions as answers, such as: What's the ratio of preventative vs. detective measures? How extensive should preventative measures be around the largest asset base or revenue stream?

Since every industry is different, clear-cut fraud prevention or detection standards that can be deployed across companies...