Question

1. What is the connection between the Sarbanes Oxley Act and an internal control framework?  

2. The COSO framework identifies “a commitment to ethics & integrity” as an important "attribute" of a company’s control environment (i.e. company culture).   Please list at least 4 activities (not definitions of ethics/integrity or value/philosophy statements), but specific company’s practices, procedures and/or actions) that demonstrate it has a highly effective “ethical culture” as it relates to a review of ICFR.

Answer 1

1) The Sarbanes oxley act requires public companies to strengthen audit committees, perform internal controls tests, make directors and officers personally liable for the accuracy of financial statements, and strengthen disclosure.

2) The board should consider the audit committee’s role in overseeing the company’s ethics and compliance programs, noting that NYSE-listed companies are required to have the audit committee oversee legal and regulatory compliance.

Directors are responsible for maintenance of financial records and preparation of financial statements that are true and fair and free of material misstatements

If the company has implemented an elaborate IT system, the company ought to have defined access rights, .authorization controls and created a set of protocols to ensure that the IT system based controls are robust and do not dilute the quality of financial records or reporting

Physical security and access to IT resources should be maintained.