IIA Urges Congress to Modernize SOX Act, Elevating Internal Audit's Role

The Call for SOX Modernization

The Institute of Internal Auditors (IIA) has released a significant public policy position paper, urging Congress to modernize the Sarbanes-Oxley (SOX) Act. This move comes as policymakers consider evaluating the effectiveness and cost implications of SOX compliance, more than two decades after its enactment. The IIA emphasizes that while SOX has been a cornerstone of corporate governance and financial reporting integrity, the evolving risk landscape necessitates its adaptation. The goal is to ensure the law continues to protect investors and strengthen financial markets while simultaneously promoting greater efficiency and reducing unnecessary compliance burdens for organizations.

Integrating Internal Audit into the SOX Framework

A core tenet of the IIA's recommendations is the formal integration and recognition of the internal audit profession within the SOX framework. Currently, SOX does not explicitly define or acknowledge internal auditing, despite the critical role internal audit functions play in supporting compliance and strengthening internal controls. This lack of clarity, according to the IIA, often leads to operational inefficiencies, duplicative efforts, and increased costs. By formally codifying the definition of internal auditing and recognizing its standards, roles, and responsibilities, the IIA believes that internal audit can more effectively provide assurance to governing bodies and executive management, thereby enhancing SOX compliance.

Key Recommendations for Policymakers

The IIA has outlined five key recommendations for policymakers to consider when examining potential updates to SOX:

• Enhance Legal and Regulatory Clarity: Codify the definitions of "internal auditing" and the "internal audit function" and formally recognize the profession's standards, roles, and responsibilities.
• Re-examine Compliance Understandings: Review contemporary interpretations of SOX Sections 302 and 404, focusing on internal audit's role in meeting these requirements.
• Strengthen Internal and External Auditor Partnership: Foster improved coordination across the broader assurance ecosystem.
• Explore Cost Reductions: Identify opportunities to reduce SOX compliance costs through emerging technologies and enhanced collaboration with internal audit.
• Encourage Deeper Regulator Engagement: Ensure internal auditors have a voice in policy discussions and that stakeholders understand the value internal audit provides in protecting investors and capital markets.

These recommendations aim to create a more efficient and effective regulatory environment, leveraging the expertise of internal audit to benefit both organizations and investors. The IIA has committed to serving as a technical resource to Congress and federal regulators as they deliberate on the future of SOX and strategies to strengthen U.S. capital markets.