SOX Aligned Internal Audit for a Multinational Automotive Components Manufacturer

Do the controls work, and can we prove they worked to a reviewer who will not accept our word for it?

In a group reporting environment, the requirement is not simply that controls operate. It is that the evidence of their operation is documented to a standard an external reviewer will accept, in a form that maps to the group control framework, within the reporting calendar. A control that worked but cannot be evidenced is, for group reporting purposes, indistinguishable from one that failed. That distinction is the entire discipline of SOX aligned testing, and it is where local internal audit work most often falls short.

Five workstreams carried the engagement, structured so that severity classification rested on evidence rather than on negotiation with process owners.

Process walkthroughs were conducted with the people who operate the cycles, not from documentation, to surface controls that exist on paper but have been abandoned.

Design was assessed before operation: whether a control, operating exactly as intended, would actually address the risk. Operating effectiveness was tested on samples sized and selected defensibly, with every test documented to the standard the group auditor would need to rely on it without re-performance. Exceptions were investigated for root cause (training gap, system limitation, capacity constraint or deliberate override) rather than tallied. Findings were rated by severity against defined criteria, with actions tracked to named owners and closure dates.

Three disciplines separated this engagement from internal audit work that gets re-performed.

First, evidence written for the group auditor. Documentation was prepared on the assumption that a group auditor would rely on it without speaking to the tester. That assumption raises the standard materially and is the difference between work that is relied upon and work that is repeated.

Second, design and operation kept separate. Conflating the two produces remediation plans that fail. Separating them turns the audit report into a sequenced remediation programme.

Third, root cause over exception count. An exception rate is a symptom. Establishing whether the cause is training, system, capacity or override determines both the severity rating and the remedy, and it is the analysis that makes audit committee reporting useful.

A group reporting environment where local control testing has been questioned or re-performed by the group auditor. Internal audit findings that recur year on year without evidence of remediation. Control testing where design and operating deficiencies are reported together. IFC testing under the Companies Act that has become a documentation exercise rather than an assessment. Manufacturing operations where procurement and inventory controls have not been independently tested. Audit committee reporting that does not distinguish severity in a way the committee can act on. Preparation for group reporting, IPO readiness or an incoming institutional investor requiring control assurance.

A group reporting environment where local control testing has been questioned or re-performed by the group auditor. Internal audit findings that recur year on year without evidence of remediation. Control testing where design and operating deficiencies are reported together. IFC testing under the Companies Act that has become a documentation exercise rather than an assessment. Manufacturing operations where procurement and inventory controls have not been independently tested. Audit committee reporting that does not distinguish severity in a way the committee can act on. Preparation for group reporting, IPO readiness or an incoming institutional investor requiring control assurance.