In my opinion, the CPA Firm that is hired/paid by the client is an “external”, not an “independent” auditor, and should be so designated, together with an explanation for the distinction, in an Annual Report.

Public companies could be assessed amounts that will fund audits by a governing authority – with the hiring, payment and control of the auditing firm being accomplished by that authority. This would help provide true independence and the protection of shareowner investments that should be occurring.

Richard J. Hamill, Sr.
President
Foundation for Audit Excellence

Thank you for speaking the truth.

The fact is that SOX is treated as just another “problem” by the vast majority of managers of publicly-held corporations. External audit firms and SOX consulting firms simply have used the law as another way of bilking clients out of enormous amounts of additional money.

There was never any real endorsement of the substance behind the legislation, rather form has been assiduously adhered to and no benefit to shareholders has been seen in most publicly-traded companies.

I left a job I loved last April, because I was being harassed by my boss for refusing to make control gaps in the company’s network security (which left the company enormously vulnerable to fraud by collusion, and customer’s financial information at high risk of being stolen) “go away” and this is the third job on which I have been in which I uncovered similar irregularities during the course of completing my SOX audit duties (I worked at both Freddie Mac and Fannie Mae, and knew that both those companies were rotten to the core by the end of July of 2006).

I am now looking for work with government, in the not-for-profit sector, or in management accounting. My experience tells me that any auditor who actually takes his job seriously and who actually believes an internal SOX audit should report what actually exists at a company risks being forced out of his job. I have found that there is no real independence of internal audit departments in most public companies, and that the people who are running those departments are in the pockets of management, completely beholden to CFO’s and Controllers for advancement of their careers, and usually members of management teams promoted into those “independent” positions. Come on, people! No one is going to turn in his/her buddy. People just don’t act that way. There’s no reward in it!

Add to that problem the fact that external audit firms, especially the Big 4 Firms, complete work that is about as shoddy as it comes and you have a guarantee for failure of Sarbanes-Oxley. It turns out that the issues I uncovered in 2007 at my last employer had been reported in the internal audit of 2005 (which had only been partially completed), but because of the arrogance of the external auditor on the engagement, and due to the failure of the contracting firm completing the internal audits in that year, no one actually understood the issues, and while they were in the company’s summary of control deficiencies, no one on the external audit side actually “got” the problem. When my former boss simply removed those items from the summary of control deficiencies for my former employer in 2006 no one noticed.

Along I come, completing good work, competently and cogently writing test procedures, work papers, and documentation of findings and all of the sudden the external auditors understand the gravity of the control gap, and start making waves about material weaknesses or inability to rely on IT controls for the company. In the end I had to resign my job, and the external auditors are most-likely earning double what they earned in 2007. My former boss has received yet another promotion (she’s now a Sr. VP of the company). I’ve been out of work since April.

Sarbanes-Oxley is a joke, unless people like the former CEO’s and CFO’s of companies like Freddie, Fannie, Bear-Stearns, etc. all go to jail for a very long time. In addition, the only way the law will actually work is for external audit firms’ relationships with their clients to be completely transformed. I’m an advocate of financial statement audits becoming the responsibility of the US Government, frankly.

Until those things happen, investing in the stock market is a crap game for the average Joe/Jill. Corporate executives will continue to report in ways that help them to pump up their compensation packages, and external auditors will rubber-stamp what those executives do, for the most part.