Corporate governance: Big changes ahead

Abstract

responsibility of management and not the external auditor's responsibility.Internal control procedures should be properly documented and internal audit should routinely test controls. According to the Act, management is now required to issue a report on internal controls and evaluation of controls. Internal audit should aid in this task. New systems implementation teams should include internal audit to ensure controls are made a focal point of the implementation.New U.S. federal securities laws require corporate management to document a company's overall internal control assessment in each annual or quarterly report. The report needs to be based on an evaluation performed 90 days prior to the report date. 3 The internal control structure is not the sole responsibility of internal audit. Boards of directors and senior management have to understand their company's internal controls and not just rely on internal auditors and the external auditors. Controls need to come out of the closet they have been hiding in. Outdated flowcharts need to be analyzed and updated. Controls must now be viewed as central to the "company culture."Controls are one reason Enron toppled. Enron's board waived their conflict of interest policy, allowing the CFO to invest in the corporation's special purpose entities (SPEs). The board did not follow up to ensure the mandated compensating controls were being followed. 4 Key participants in a company's internal control system are the audit committee and internal auditors. Internal audit reviews the design and practice of internal control procedures throughout the corporation. The results of their testing and follow-up procedures should be reported to the audit committee. Since the core of top management's job is to ensure the evaluation and control of risk, companies should consider basing a portion of executives' evaluation on design of and compliance with internal controls. Currently, most executives are not aware of the internal controls in place and view this evaluation as an external audit function. Based on the legislation passed, this attitude needs to change.Information systems personnel should not be forgotten in this process. Systems personnel usually do not have a broad perspective relating to overall internal controls involving the entire company. When new information systems are implemented, internal controls should be part of the package. Often they are not. The system implementers, who can no longer be the external audit firm personnel, must work side by side with internal audit to ensure a solid foundation of internal controls. The attitude that controls are the external auditor's job is outdated and dangerous. AUDIT COMMITTEESAt many companies, audit committees have a limited role and a backseat position. The Act focuses much attention on the need for a change in the role of the audit committee. Today, the audit committee often functions as a "rubber stamp" to the auditors "clean opinion." Under the Act, audit committees are now responsible for (1) oversight of external audito...