I recently got into a debate with a friend (a former CAE) about whether internal audit is prevented from doing its full job because of its SOX testing demands.
This seems to be a topic that won’t die – although it should!
Part of his (and several others’) argument is that the CAE is given a budget by the CFO, perhaps approved by the Audit Committee, and priority is given to the SOX work. Assurance and other ‘real’ internal audit work is done with what is left over.
The budget is fixed based on the prior year, corporate earnings, and so on.
While I recognize that may be the situation for some CAEs, I (sorry to say) believe that this is more likely than not the result of a failure by the CAE.
The budget should be determined by the work that needs to be done (including SOX and any other compliance and advisory work) and not the other way around, where the work that is done is determined by the budget.
I actually like how this is addressed in GIAS!
Standard 8.2: Resources
Requirements: The chief audit executive must evaluate whether internal audit resources are sufficient to fulfill the internal audit mandate and achieve the internal audit plan. If not, the chief audit executive must develop a strategy to obtain sufficient resources and inform the board about the impact of insufficient resources and how…
