Using Internal Auditing to Mitigate Risk from the Sarbanes-Oxley Law

What keeps your CEO up at night? It’s risk!! What are some of these risks? Of course there are always the financial and competitive risks. But now, because of the Sarbanes-Oxley Act (SOX), the CEOs and CFOs of public companies must certify their company’s financial statements. Also, each year they must certify the effectiveness of the system of internal controls mandated by the Act. In the past, top management could claim ignorance of their organizations’ operational failures. This no longer holds. Lack of knowledge of problems is not an excuse. And, top management is now risking civil and criminal penalties.

In October 2003, Paul Palmes¹ and I wrote an article for Quality Progress² describing how quality and environmental management systems (QMS/EMS) can help top management maintain effective corporate governance and satisfy the requirements of SOX.³ Since then, the SOX-Q/E Team has been formed to identify how ISO 9001:2000⁴ and ISO 14001:1996⁵ can be used to