Six Sigma
by Robert K. Minniti, CPA, CFE, MBA
With the new requirements implemented under the Sarbanes-Oxley Act of 2002, publicly traded corporations are now required, under section 404 of the Act to document and attest to their internal controls on an annual basis. This attestation is required to be included in the corporation's annual financial statement. External auditors are required to provide an opinion on the financial statements taken as a whole, including the attestation of internal control. The CEO and CFO are required per section 302 of the Sarbanes-Oxley Act of 2002 to attest to the appropriateness of the financial statements and disclosures on a quarterly basis.
In order to properly evaluate and attest to the internal controls of a corporation it will be necessary to conduct audits on the company's internal controls. Unlike financial audits, internal control audits are process audits and are measured using attribute sampling. Attribute sampling requires the auditor to review the source documents to determine if the internal control or process has been followed. (For example, was a disbursement properly approved prior to being processed?) Attribute sampling is a statistical sampling method used extensively in the Six Sigma quality improvement process. (For more information on the Six Sigma process, see www.isixsigma. com.)
With Six Sigma, the methodologies for determining sample size, confidence intervals, defect measurement and benchmarking are already well defined and established. It is therefore possible to use the Six Sigma methodology to perform internal control audits. Companies that are currently using the Six Sigma methodology for other business processes will be able to leverage the employees who have already been trained as Six Sigma Black Belts and Six Sigma Green Belts, as source of auditors for the internal control audits. Additionally, training on Six Sigma processes is readily available in the market for companies who do not already possess these skills. A competent individual could then design the internal control audit using the Six Sigma methodologies and the Black Belts and Green Belts could conduct the data sampling.
Using Six Sigma to conduct internal control audits would allow a company to assign a sigma level to internal controls and have a predefined, and internationally accepted metric for measuring internal controls. External auditors cannot rely on internal auditors to test items of opinion or judgment. Since the Six Sigma process uses a statistical modeling process that can be easily quantified and reproduced, the external auditors would be able to rely on this quantifiable data.
Using the Six Sigma methodology to test the internal controls documented per Section 404 of the Sarbanes-Oxley Act would:
•Increase the validity of the internal control audit.
•Increase the ability of management and the external auditors to rely on the audit to confirm and attest to the internal controls as required by the Sarbanes-Oxley Act of 2002.
•Allow management to have a higher level of reliance that the financial statements are presented fairly, without material misstatement.
• Management would have better information, reported in a timely manner, on internal controls, which would enhance management's decision-making process, including how to better allocate resources.
• Where defects in internal controls are discovered, Six Sigma projects could be initiated to discover the root cause of the defects and recommend changes in the internal controls to correct the defects.
• Using an internationally accepted predefined metric to measure internal controls, which could subsequently be reported in the financial statements, would increase the transparency of the financial statements and would increase the value of the information presented therein.
Implementation of this process would allow a company to compare its internal controls to industry benchmarks. It would also allow a company to evaluate period-to-period changes in the internal control structure. Management would have quantitative data to compare to industry benchmarks and prior periods, reducing the reliance on opinion and subjective judgment in the internal control audit. Further, since an internationally accepted statistical sampling methodology is being used to document the internal controls, it reduces the risk and provides more reliable measurement to the executives who are now required by law to attest to the internal controls of their corporations.
Since documentation of good inter nal controls allows the auditors to reduce the sample size required in the test of details, this process could potentially reduce the immediate costs of the internal audits and the long-term costs of the external financial audits, while increasing the value and transparency of the information provided in the annual financial statements.
Robert K. Minniti, CPA, CFE, MBA , and Six-Sigma Black Belt is currently working in industry for a Fortune 500 company. He can be reached at minniti.cpa@cox.net.
This content has not yet been Rated.
To Rate content, please Login.
