英语论文网

ses penalties of fines and/or imprisonment up to 10 years on any accountant who knowingly and wilfully violates the requirements of maintenance of all audit or review papers for a period of 5 years (source: Sarbanes Oxley Act 2002)

But after SOX Act passed in 2002 was created arguments between group support and against group of this SOX Act, they argued about strength and weakness of this Act.

Supporters group think SOX Act is helpful and will improve and create benefits in auditing, internal control. An article in the Harvard Business Review, they researched and gave the following benefits:

Strengthened control environment

More reliable documentation

More standardized process for IT and other functions

More effective use of automated and manual controls

Increased audit committee involvement

But against group don't think so and they gave disadvantages and following negative effects of SOX:

40% executives say SOX Act created a cost burden that suppresses stock prices

Compliance cost were cited as the biggest complaint about SOX Act

IT costs and other functions involve internal control will increase for improve internal control system and audit techniques if the management of these systems based on IT, etca€|

In fact, for using SOX effective is not easy and with conclusion of 1 IT auditor have been working with SOX section 404 and this IT auditor gave followings reasons

. Text book auditor vs. real life IT process auditor

There is a big gap between SOX auditor and IT auditor, its matter on what do you see day by day. The SOX auditor main job is work with detail documentation. SOX auditor need to examine a lot of document. Complete and detailed document make them happy. But, IT auditor has a very different view, IT main focus is maintain availability of the system, most of them did not care about whether all process should be written in paper, should be signed, approved and others SOX auditor jargon.

If SOX auditor pressure come from deadline and the IT auditor pressure is from IT board that need IT process run effectively, surely no one happy. We have found several auditor that become paranoid with all part of SOX auditor, whether their appearance or their style.

. Never ending control frequency

Frequency of this control is daily and should be review monthly. In SOX, every control that we created has a different control e.g. control for program changes it event based, so when you have a change request then you should follow that SOX rule you have been made. Control for incident monitoring is daily, so everyday you should record the incident that happened but someone think should record semi annual but other persons not agree and at the end, they think it's no longer suitable.

. Global problem local hell

SOX said that every company that listed to NYSE should follow the compliance; every subsidiary company that owned by the company also should follow. What that mean? This means that making the local or subsidiary company becoming hell. Everybody now that local subsidiary company has different way perform the businesses compare to the head quarter. Implementing SOX is just the same as moving a very big problem to each subsidiary.

. Costs for hire