IIA chief: Sarbanes-Oxley puts internal auditing 'in the limelight'.

• Author: Heffes, Ellen M.
• Position: Financial REPORTING - Institute of Internal Auditors - Interview - Excerpt

In the post-Sarbanes-Oxley era, internal auditors are helping to steer the projects for complying with Section 404 for testing internal controls; they are also in the best position to alert senior management to potential deficiencies before they become bigger problems.

A certified public accountant and certified internal auditor himself, the current President of The Institute of Internal Auditors, David A. Richards, recognizes the value internal auditors bring to their organizations and their link to corporate governance. In an exclusive interview with Executive Editor Ellen M. Heffes, Richards talks about the enhanced role of internal auditors.

Since coming to his post at The IIA's global headquarters in 2004, Richards has seen the organization's membership surge 15 percent to 115,000 last year; 2006 growth expectations are set at 20 percent. What follows are excerpts of the interview; more can be found at www.fei.org/mag/articles/5-2006_fr.cfm.

Talk about internal auditing's role post-Sarbanes-Oxley.

Richards: It's certainly been a very hot topic with our members, and for quite some time now because internal auditors have been a very integral part in almost every case that I've come in contact with. The feedback we're getting from surveys we run is that internal auditors, at least in year one, were spending as much as 50 to 100 percent of their time on Sarbanes-Oxley-related control assessment work for their companies. Although we believe that has dropped somewhat in year two, it is by no means a minor part of the workload that has been heaped on the internal audit function to help management prepare for their sign-off.

So, Sarbanes-Oxley has elevated the importance of internal auditing?

Richards: It's certainly been in the limelight a lot more. When Sarbanes-Oxley was enacted, a high percentage of companies turned to their internal audit departments and said, "We need you to help the organization figure out how to do that."

So internal auditors worked with a management team to help determine how to document the company's internal controls over financial reporting, which controls needed testing and how that testing should be performed; what should be done about controls found to be ineffective; and the preparation of the statement management would sign.

The IIA has issued a position paper on what we believe the internal audit function should do relative to the 404 assessment. We believe that the law, as enacted, is intended to result in...