audits

Case study: The Gap and employee access controls

Jim Kim — Fri, 01 Aug 2008 07:37:58 -0400

Retailers spend a lot of time worrying about PCI and Sarbanes-Oxley. As CIO notes, passing an audit means showing definitively that you can control employee access to customer and other data. Unfortunately for Gap Inc. Direct, which has to control for the online operations at Gap, Banana Republic, Old Navy and other stores, the IT environment was decidedly heterogeneous. So for PCI and Sarbox audits, server logs had to be manually collected to show who accessed files and when for hundreds of servers. The process required up to 10 people working at least part-time on every audit. The remedy: an identity management solution (this one from Likewise Software). The implementation cost: $400,000. You've likely heard such success stories from vendors, but in this economic environment, it is not fait accompli that the benefits will outweigh the costs. Some of you may have developed some scripts that are good enough. Automation in many cases will make sense--as long as you can truly afford it.

For more:
- here's the CIO article

PCAOB takes PwC to task

Jim Kim — Thu, 03 Jul 2008 09:33:15 -0400

There has been a lot of talk about how the new Sarbanes-Oxley, as rendered in the PCAOB's AS5, will ease the burden and make audit firms less conservative in their approach. But you have to wonder, despite all the talk of a principles-based system, if that is really possible. Consider the scolding that PricewaterhouseCoopers just took from the PCAOB. (It should be said that other accounting firms regularly take similar medicine.) The PCAOB review found various GAAP errors, instances where standard audit procedures were not followed, cases of improperly documented work, and so on. PwC takes issue with a lot of the critique, but the point is that when it comes to audits, audit firms have every reason to be a big pain in the butt.

For more on PwC and the PCAOB:
- here's a cfo.com article

So is AS5 really working?

Jim Kim — Thu, 03 Jul 2008 09:30:26 -0400

There was some skepticism when AS5 was released by the Public Company Accounting Oversight Board (PCAOB). There were lot of benefits on paper, and the changes seemed significant in areas related to materiality, walkthroughs and the like. But you can never tell how specific audits will go. Protiviti has just released a survey that has found "approximately four in 10 internal audit departments have been able to decrease the amount of time devoted to Sarbanes-Oxley compliance activities since the new guidance and standard were announced." This has allowed companies to use the compliance process to more strategic ends. Obviously, there's a marketing component here, but it does seem that AS5 is working pretty much as advertised. Still, that doesn't mean the process will be all smooth sailing. I maintain that IFRS represents some Sarbox challenges that may be more than trivial. And smaller companies, despite the most recent 404(b) reprieve, will face some big challenges.

For more:
- here's a copy of the survey

Countrywide on the hot seat

Tue, 13 May 2008 06:59:59 -0400

Countrywide has no choice but to promise to do better. As the people increasingly question the wisdom of Bank of America's plans to purchase it, it faces criticism in other areas that get to internal control issues. At a congressional hearing, the mortgage giant said it will hire an independent auditor to review its treatment of loans whose borrowers have filed for bankruptcy and review claims of borrower abuse. It also will adopt a series of "best practices" issued by a national group of bankruptcy trustees. An interesting question: Is this a Sarbanes-Oxley issue? On one hand, the issue of abusive fees feeds revenue, which might bring it in-scope. You have to wonder how the auditor's assessed the issue. KPMG is its. As you recall, it took its lumps over the New Century implosion.

For more:
- here's some background from Dow Jones via CNNmoney.com

Internal auditors expanding scope of duties

Tue, 13 May 2008 06:59:59 -0400

It's fair to say that in the Sarbanes-Oxley area, internal audits focused on financial risks and related controls. But some have discerned that this focus came at the expense of other issues, such as operational and non-financial IT risks. Now, says Financial Week, the pendulum seems to be swinging back. PwC, among others, thinks internal auditors can "leverage" AS5 to focus on other areas, such as hiring and retention risks, and governance risks. This seems to be underway. PwC has found that the percentage of internal audit groups that dedicated at least half of their resources to Sarbox compliance decreased from 41 percent to 27, the article notes. This likely will be a big-company trend. Smaller companies just ramping up can likely afford anything other than a strict financial focus.

For more:
- here's the Financial Week article

Audit conflicts must go!

Tue, 29 Apr 2008 06:59:59 -0400

We recently suggested it would be a good idea for firms to get rid of all potential conflicts of interest in the audit process regarding directors or executives. We noted the case of Feldman Mall Properties, which hired an accounting firm owned by one of the directors. As it turns out, the Public Company Accounting Oversight Board is moving on this issue, according to cfo.com. It seems to favor a rule that would require accounting firms to inform audit committees about any potentially tricky relationship. Anyone in an important financial role that might be able to influence the auditor would be required to disclose the relationship. Only then would a contract be allowed. In many ways, this seems like a no brainer. Audit committees need all the information they can get about these sorts of relationships before making decisions.

For more:
- here's the cfo.com article

Unintended consequences watch: Oil industry reserves

Tue, 15 Apr 2008 06:59:59 -0400

Here's another one of the unintended consequences of Sarbanes-Oxley: Arena Resources is among the many oil and gas companies that hires experts to estimate how much oil they have in reserves. But in the Sarbox era, those third-party experts are said to have become more conservative in their estimates. The result is lower estimates that can really jack up depreciation costs, which are based in part on the amount of undeveloped reserves. In the case of Arena Resources, the change led to earnings that were 11 cents a share below expectations, according to Investors' Business Daily. Few would have predicted that. I'm sure you have your own examples.

For more:
- here's the article via CNNmoney.com

One way to profit after compliance lapses

Tue, 01 Apr 2008 07:59:59 -0400

"... You can't legislate ethical behavior." So says Walter Pavlo Jr., who was jailed for embezzling $6 million from MCI in 2001. What does he do know? Why he's on the speaking circuit of course. For a fee, he'll recount how he faced a lot of pressure to get some debts off the books of MCI, which lead him down the slippery slope to prison. The more illegal stuff he did, the more he was accepted, notes the Pittsburgh Tribune Review. We have to ask in light of the mortgage fraud cases we're now seeing whether anything has changed. Sarbanes-Oxley was the right idea, but it cannot reign in human behavior. There will always be cheats. Hopefully, the pressure for executives and auditors has been lessened a bit.

For more:
- here's the article from the Pittsburgh Tribune Review

Templates for internal controls

Tue, 01 Apr 2008 07:59:58 -0400

Chances are your don't have a controller at your firm. Some of you don't have a CFO or dedicated compliance exec. But you do have some internal control issues. So how do you get started? In such situations, templates are not a bad idea. Bizmanualz, of St. Louis, has just released a product aimed at getting companies up to speed quickly when it comes to compliance. It offers a range of templates, editable processes that cover everything from risk management to audits to liquidity, and more. Something to think about. Release

Is the Sarbox hiring boomlet over?

Tue, 25 Mar 2008 07:59:59 -0400

People jokingly refer to Sarbanes-Oxley as the full employment act for accountants. Clearly, a lot of accountants, as well as finance and IT types, owe their jobs to the law. But the San Francisco Business Times notes that the hiring may be waning--even as the top firms hone their hiring practices to a near science. Controls are placed at many companies, and processes have been streamlined. There may actually be some layoffs in the works in some Big Four offices. The economy may have a lot to do with this. Companies are not going to be in expansion mode. While audits will always be necessary, a lot of related projects, especially on the consulting side, may not get funded. On the client side, you can bet a lot of departments are feeling headcount pressure.

For more:
- here's the San Francisco Business Times article
- here's an article on the art of recruitment from cfo.com

Related Article:
Wasn't Sarbox supposed to prevent this? Article