Sarbanes-Oxley and the New Internal Auditing Rules

ROBERT R. MOELLER is an internal audit specialist and project manager with a strong understanding of information systems, corporate governance, and security. A CPA, CISA, and a CISSP, Moeller has managed several information systems audit functions and served as audit director for Sears Roebuck. In the late 1990s, Moeller launched a business, Compliance and Control Systems, that delivered seminars throughout the United States on corporate governance, COSO, and the importance of Codes of Conduct well before Sarbanes-Oxley and today's interest in those areas. A frequently published author and professional speaker, Moeller provides insight into many of the new rules impacting internal auditors today as well as the challenges audit committees face when dealing with Sarbanes-Oxley, internal controls, and their internal auditors.

• Preface xiChapter 1 Introduction 1Accounting and Auditing Scandals and Internal Audit 1What are the New Rules? 3Who will Find this Book Useful? 7Chapter 2 Internal Audit and the Sarbanes-Oxley Act 9“Where were the Auditors?” Standards Failure 10Sarbanes-Oxley Overview: Key Internal Audit Concerns 12Impact of the Sarbanes-Oxley Act on the Modern 57Internal AuditorChapter 3 Heightened Responsibilities for Audit Committees 59Audit Committee Charters and Other Requirements 60Board’s “Financial Expert” and Internal Audit 64Helping to Establish Documentation Procedures 67Controlling Other Audit Services 69Establishing Open Communications 70Chapter 4 Launching an Ethics and Whistleblower Program 71Launching an Organization Ethics Program 72Establishing a Mission or Values Statement 79Codes of Conduct 81Whistleblower and Hotline Functions 89Auditing the Organization’s Ethics Functions 99Chapter 5 COSO, Section 404, and Control Self-Assessments 103SOA Section 404 104COSO Internal Control Framework 123Violation Penalties: Organizational Sentencing Guidelines 146Control Self-Assessments 155Chapter 6 IIA, CobiT, and Other Professional Internal Audit Standards 165Institute of Internal Auditors Standards for Professional Practice 165CobiT and Information Technology Governance 175ASQ Audit Standards: A Different Approach 183Chapter 7 Disaster Recovery and Continuity Planning after 9/11 189Business Continuity Planning and the New Language of Recovery Planning 190Continuity Planning and Service-Level Agreements 194New Technologies: Critical Data Mirroring Techniques 195Establishing Effective Contingency Policies: What are we Protecting? 197Building the Disaster Planning Business Continuity Plan 198Testing, Maintaining, and Auditing the Continuity Plan 206Continuity Planning Going Forward 211Chapter 8 Internal Audit Fraud Detection and Prevention 213Red Flags: Fraud Detection for Auditors 214Public Accounting’s New Role in Fraud Detection 220IIA Standards for Detecting and Investigating Fraud 223Fraud Investigations for Internal Auditors 225Information Systems Fraud Prevention Processes 226Chapter 9 Enterprise Risk Management, Privacy, and Other Legislative Initiatives 231Enterprise Risk Management 231Concurrent with SOA: Other Legislation Impacting Internal Auditors 243Chapter 10 Rules and Procedures for Internal Auditors Worldwide 257SOA International Requirements 258International Accounting and Auditing Standards 259COSO Worldwide: International Internal Control Frameworks 267ISO and the Standards Registration Process 272ITIL Service Support and Service Delivery Best Practices 279Chapter 11 Continuous Assurance Auditing Future Directions 293Implementing Continuous Assurance Auditing 294Internet-Based Extensible Mark-Up Languages: XBRL 302Data Warehouses, Data Mining, and OLAP 306Newer Technologies, the Continuous Close, and SOA 311Chapter 12 Summary: Internal Auditing Going Forward 313Future Prospects for Internal Auditors 313Glossary 317Index 321