CHAPTER ONE
INTRODUCTION
1.1 BACKGROUND STUDY
As a result of some notorious recent audit failures involving large corporations around the world especially in the United States, the
Sarbanes Oxley Act (SOX) was enacted in United States of America since 2002. This ACT has become a de facto international standard for
good governance and controls of Companies. It requires that (Section 302) the chief executive and chief financial oicers of public
companies attest to the accuracy of financial reports and auditing process, in most cases, must provide a reasonable safeguard against
fraudulent and inaccurate financial reporting. ‘Financial statements cannot be useful if they are based on unreliable and inaccurate
recordings of transactions’ Elmaleh, ( 2012). Following the financial crisis and the catalogue of public sector scandals, better education
and improvements in the transparency of the audit process are needed (ACCA, 2010).
According to Michelson, Stryker and Thorne (2009), Sarbanes-Oxley Act (SOX), Section 404 requires public companies to establish
adequate internal controls over financial reporting. Turnbull Report 1999 in the UK provided principle-based guidance for creating strong
internal control system and later incorporated into Combined Code, revised in 2005 also presents standalone document on internal
controls.
“The application of information technology (IT) has become central to the strategy and business processes of many entities. So, just as IT
has become an integral part of the business, IT governance is now seen as an integral part of enterprise governance. In recognition of the
importance of IT governance, an IT governance framework, Control Objectives for Information and Related Technology (COBIT) was
developed in 1996 as a reference framework for developing and managing internal controls and appropriate levels of security in IT. COBIT
provides a set of generally accepted IT control objectives to assist entities in maximizing the benefits derived through the use of IT and
developing the appropriate IT governance and control in a company” (IFAC, 2006). While Committee of Sponsoring Organizations of the
Treadway Commission, (COSO) in the US and Turnbull report in the UK focus on the achievement of business objectives at the overall
entity level, COBIT focuses specifically on information technology. These developments in internal controls issues have created
similar developments in some other countries such as Canada, the European Union, Hong Kong, South Africa etc.
Organizations that can survive the currents in the uncertain competitive business environments must, as matter of necessity, ‘know how
to take advantage of opportunities and counter threats, in many instances through eective application of controls, and therefore improve
their performance’. Internal control is, therefore, a vital aspect of an organization’s governance system. Thus, internal controls involve
putting in place the right kind of internal measures that will enable an organization to capitalize on opportunities while osetting the
threats. An ability to understand risk, manage risk, implemented, and actively monitor risk by the governing body, management, and other
personnel is key to taking advantage of the opportunities and countering the threats in order to achieve the organization’s objectives (Li,
2012).
Apart from the prevention and detection of fraud, internal controls are put in place to reflect the strength of the overall accounting
environment in an organisation as well as the accuracy of its financial and operational records. “Data security failures can cost a company
in several ways. Fines for a single
Incident have reached as high as $15 million. Legal, IT recovery, and other costs can be several times that. Violations of data security laws
can lead to increased regulatory oversight. And then there’s the damage to reputation” (Drew, 2012).
One main managerial function that centrally is tasked with the business of capitalising on opportunities and osetting the threats
is the role of internal audit. Internal audit as a whole, in essence, can be seen as a special kind of economic control which is concerned
with any phase of business activity which may be of relevant to management. ICT has virtually become indispensable part in the
operations of any modern accounting and management information systems. Auditing, therefore, involves going beyond the
accounting information or financial records to obtain a comprehensive understanding of the operations under review (Chun, 1997). This is
done by testing and understanding of the system is required ‘to substantiate their opinions and/or provide advice to management on
internal controls’ (IT Governance Institute, 2007).