The internal auditor, from today forward.

• Author: Swanson, Dan

From Swanson on Internal Auditing by Dan Swanson. Copyright 2010 by the author. Published by IT Governance Publishing (www.itgovernance.co.uk).

CONTRARY TO WHAT some cynics say, the financial crisis was not proof that SOX compliance is worthless. SOX was passed to ensure the accuracy of financial reporting, and with a very few questionable exceptions, none of the culprits in the financial crisis experienced reporting failures. They experienced risk management failures. The difference is huge. Nobody, in the lead up to the crisis, was telling investors, "We have $1 million in revenue" when in fact they only had $500,000. They were telling investors, "We have a portfolio of bonds we can sell for $1 million" that they could only sell for $500,000 when they tried to sell it.

Why didn't those companies know the portfolio was worth less? Why didn't they plan scenarios with lower figures? Why did they buy $1 million worth of bonds in the...