The Institute of Internal Auditors has formally recommended that the requirement for an external auditor to attest to a company's internal controls be removed under Section 404 of the Sarbanes-Oxley Act.
The IIA said that it believes the requirement is redundant and the other two attestations required under SOX are sufficient to carry out the legislation's intent. The institute also said that it believes such a change will increase shareholder value by decreasing company audit costs.
"Mitigating organizational risks goes far beyond developing, documenting and testing financial controls," said president Dave Richards, in a statement. "It's important to recognize that a large part of internal auditing's focus has been diverted away from its audit plan to support management's 404 compliance efforts. ... Stakeholders should be equally concerned with all risks and related controls that may impact the sustainability of their organization not just those related to financial reporting."
The group's stance is based on survey feedback from a number of internal audit practitioners working in a wide range of industries.
The survey indicated additional challenges including questionable cost-benefits of SOX, the legislation's capacity to significantly impact the confidence of investors, and the sustainability of the process -- all of which mirrored a survey conducted a year ago.
Some benefits of SOX implementation recognized be respondents included a more engaged system of internal control over financial reporting with active participation of the board, audit committee, and management, as well as a broader understanding of controls throughout an organization.
The full survey results and the IIA's formal suggestions to both the Securities and Exchange Commission and the Public Company Accounting Oversight Board are available at
