As late as the beginning of the twenty-first century, the evolutionary practice of
internal auditing resulted in developing internal audit best practices and adding
value to the organization and its stakeholders by understanding the link between
internal audit and organizational goals. Before the enactment of Sarbanes-Oxley Act
of 2002 (SOX), internal audit services were focusing on detection not prevention.
Internal auditors were moving from a confrontational approach to partnering with
management and moving from a controls approach to a risk-based approach. They
were also focusing on consulting services (Roth, 2002).