Internal Audit Reports Post Sarbanes-Oxley: A Guide to Process-Driven Reporting

SECTION ONE

FROM VENI, VIDI, VICI TO SOX

Veni, Vidi, Vici.

Julius Caesar

Reports, in one form or other, are part of human history. Julius Caesar, who is often credited for conciseness, simply declared: “I came, I saw, I conquered,” which, in the original Latin, is even shorter: Veni, Vidi, Vici. However, if Caesar had written his report after Sarbanes-Oxley (SOX), those words might have been questioned, and they probably would have been generated by computer software.

Twenty-first-century internal auditors face a whole new set of challenges as they carry out their professional duty to “communicate the engagement results.”¹ The reports required by SOX deal with primarily internal control issues and are not the same as the traditional financial and operations audit reports. But since SOX, all reports written by internal auditors are being more closely scrutinized—by Audit Committees, management, and the external auditors who review their work.

While oral reports are still permissible for interim reporting, the tangible document form has become generally accepted as the best method of delivering the goods produced by the internal audit function—whether traditional or SOX-related. Without some sort of synthesis of what was observed during the audit, executives conceivably would need to reexamine all of the data the auditors covered in order to attest to their company's financial condition or adequacy of internal controls. We can live without that kind of system redundancy! The current ...