Upfront: Compliance Still Full of Holes

A recent survey of internal auditors highlights remaining gaps in corporate controls.

The vast majority of internal audit teams -- 92 percent -- see gaps in their organization's internal controls, according to a recent survey of 200 internal auditors conducted by Jefferson Wells International and the Institute of Internal Auditors (IIA) to gauge companies' progress in complying with Sarbanes-Oxley. Lack of documentation of process controls was the most frequently cited gap, mentioned by 34 percent of survey respondents. Twenty-three percent identified formal review and approvals as their problem area, and 19 percent cited segregation of duties.

These results are disturbing because internal audit is clearly playing a central role in corporate compliance efforts. When asked what percentage of internal audit's time is devoted to Sarbanes-Oxley-related work, 29 percent of respondents said between 70 percent and 100 percent. All survey participants' internal audit departments hold some compliance duties, and 53 percent have direct Sarbanes-Oxley project management responsibility.

"This survey shows that many companies still have significant ground to cover regarding Sarbanes-Oxley compliance," says Jefferson Wells' president and CEO Owen Sullivan. "The amount of resources needed to effectively implement the internal controls requirements of Sarbanes-Oxley is putting a strain on many companies' internal resources."

Respondents remain unsure about the exact nature of their external auditor's role, the study notes. "Disturbingly, this survey found that 13 percent of respondents indicated that their companies had not communicated at all with their external auditors about Sarbanes-Oxley," says Sullivan. "Those firms risk an onslaught of last-minute remediation work should their compliance frameworks fall short of the external auditors' standards."