WorldCom Whistle-blower Cynthia Cooper

In general, internal audit has better relationships now with the audit committee, and more chief audit executives are reporting functionally to the audit committee. The one problem I do see post-Sarbanes Oxley is that the role of internal audit has, in many departments, been narrowed because of Sarbanes Oxley 404 testing, which has been moved to internal audit, consuming their time and preventing them from performing risk based audits.

Section 404 wasn’t initially part of the Sarbanes Oxley Bill that passed the House. It was added in the Senate only after the WorldCom fraud. These two paragraphs in the act have proven to be an albatross for corporate America. What Worldcom and a lot of the recent corporate scandals have in common is collusion at the very highest levels of the company, which means most of the basic controls can be bypassed.

Has 404 had any positive effect?
One of the most positive impacts of 404 is that executive management and the board now recognize the importance of a strong internal-control framework, which means support for internal-audit departments that have often struggled for resources and stature. At one point early in my career I was told not to use the words internal controls in my audit reports because it aggravated Bernie; he didn't understand it. I doubt that there's a CEO in the country today who would say that.

What would you want to leave people with regarding the recent corporate scandals?
I encourage people not to give in to the thinking that fraud won't happen in their companies. History has a way of repeating itself, and based on human nature there will always be fraud. When there's increased pressure due to another boom-and-bust in the market, there may well be another rash of frauds. I think we have to do our best not to forget what we've been through and hold tight to the positive changes in corporate governance that so many people have worked to achieve.

• « previous
• 1
• 2