Designing an Internal Control Assessment Program Using COSO's Guidance on Monitoring

Bor-Yi Tsay, PhD, CPA

Section 302 of the Sarbanes-Oxley Act of 2002 (SOX) requires that CEOs and CFOs of public companies, in connection with the filing of periodic reports under the Securities Exchange Act of 1934, disclose any changes in their internal control systems. SOX section 404 further requires that management present a report assessing the effectiveness of its internal controls and that such assessment report be audited by a registered accounting firm. Aside from the legal requirements, all business enterprises need internal controls to ensure the effectiveness and efficiency of their operations. SOX, however, raises the bar of public companies' responsibilities on internal controls.