Sarbanes finally done
We've just finished our Sarbanes-oxley testing cycle for Internal audit--mgmt will continue on for the rest of the year. It was a long hard process to test year one and then transfer over to management. Some of my key observations
1) Internal Audit should NOT own the sarbanes oxley process--management needs to sign and management should own.
2) Internal audit did most of the testing because we over-scoped the controls that needed gto be tested. If we could have scoped it back further, management would have been able to handle it.
3) Internal audit still needs to be involved.
I'll have more time to post now, if there's anything anyone's looking for, feel free to post comments