Internal audit departments also will need to change their mandate for SOX Section
404 testing. Most organizations still expect internal audit to bear the primary burden
for SOX testing or similar low-end compliance testing. Internal audit needs to limit its
responsibility for such compliance testing and mainly support the testing of higherrisk
or more complex areas. This approach will help free internal audit to respond
to specific events that bring new, expanded, or unique risk as well as opportunities.
Events might include acquisitions, divestitures, joint ventures, new regulations,
globalization, or an increase in outsourcing.
In addition, with internal audit under mounting pressure to provide additional value to the
organization, the mandate will need to better align audit coverage with the organization’s
major business and operational initiatives and risks. Because internal audit’s current
mandate calls for it to be part of the team looking at areas like system implementations,
complexity of transactions, and major change initiatives, it must advance to deal with
extended enterprise risk (for example, risk related to vendors’ vendors), quantum
analytics that assess “big data” and interpret results, the move from internal systems
to the cloud, and issues resulting from global expansion of the enterprise.