Under the
Sarbanes-Oxley Act (SOX), external auditors are
required to assess the effectiveness of, and to attest
to the management’s report on, the firm’s internal
controls over financial reporting. Internal controls
and internal control systems are becoming
increasingly important in audit, so much so that an
‘internal control explosion’ has been observed
(Maijoor, 2000).