Sarbanes-Oxley Internal Controls: Effective Auditing with AS5, CobiT, and ITIL

Chapter 1. Introduction: Sarbanes-Oxley and Establishing Effective Internal Controls

As highlighted in the Preface, Sarbanes-Oxley (SOx) became U.S. law in 2002 and was the most sweeping set of new U.S. financial regulations since legislation passed in the 1930s aftermath of the Great Depression. SOx was enacted following a stream of major financial scandals at that time, with the accounting misdeeds at what was known as Enron Corporation^[2] at the head of the pack, and lots of public concerns about poor corporate governance and public accounting practices. SOx created a new regulatory authority to set public accounting auditing standards, the Public Company Accounting Oversight Board (PCAOB), which essentially replaced the American Institute of Certified Public Accountants' (AICPA's) self-regulated auditing rule-setting authority, the Auditing Standards Board (ASB). Perhaps most important, SOx changed many of the processes that public companies had used for their own governance and to report their financial results to the Securities and Exchange Commission (SEC) in the United States and to the investing public. These SOx-initiated changes touched boards of directors, senior management practices, and the adequacy of the internal controls used to support financial and other processes.

SOx has had a major impact on the activities and responsibilities of auditors, whether external auditors, who now review the adequacy of reported standards following the PCAOB's auditing standards; internal ...