# Presentation: 719947

## Fluor Hanford Internal AuditSarbanes Oxley 404

- Dianne Jackson
- Senior Director

## SOX Objectives

- Increase transparency in financial reporting
- Aimed at improving the accuracy and reliability of corporate disclosures
- Tighten time frames for filing 10-Q’s &10-K’s
- Expand rules for Audit Committees
- Executive certification of quarterly/annual reports
- Broaden requirements for Internal Controls (404)

## SOX 404 – Implementation

- Implementation will be expensive
- Implementation will require time for planning and coordination of various internal departments
- Risks related to each business process will need to be identified and analyzed
- Roles of Internal Audit will need to be established

## SOX 404 – Questions to Ask

- Does this corporate requirement extend to Fluor Hanford?
- Is this effort reimbursable?
- How does IA dedicate staff to Sox and still get the audit plan completed, as required?
- How involved will other FH organizations be?
- What business processes are within scope?

**Notes:**
What does the control structure look like and how does is operate?  What are the key control activities?  Who monitors them?  Who are the process owners?  

How are these documented?  Can we use the IA flowcharts and narratives?  Do we go back to the process owners for them to develop their control analysis?

Who is doing what?

## SOX 404 – More Questions to Ask

- What does FH control structure look like?
- Who is the process owner?
- Who is accountable?
- How does it deal with change?
- Is all of this documented?
- Can IA use the flow diagrams and narratives IA previously developed?
- How will IA demonstrate that we have reviewed the controls throughout the year?
- How does IA plan for such an unknown?

## SOX 404 – Internal Audit’s Role 

- Performed walk throughs and documented the current control system narratives
- Performed segregation of duties evaluation
- Designed and performed tests of key controls
- Identified gaps and evaluated mitigating controls
- Issued final report to management and DOE
- Conducted follow up – additional tests of controls

## SOX 404 – Fluor Hanford Scope

- Seven business processes were identified
- 102 Controls were within scope
- 74 Tests developed and performed
- 6 Internal Auditors trained

## SOX 404 – FH, Internal Audit Resources

- CY 2004
- 6 Auditors – 780 Hours
- CY 2005
- 4 Auditors – 332 Hours
- CY 2006
- 3 Auditors – 430 Hours

## SOX 404 Post Internal Audit Testing

- Fluor Hanford CIO performed self-assessments on critical business systems
- Information System Audit teams performed validations on the Fluor Hanford critical business systems
- External Auditors reviewed self-assessments, validations and conducted their own tests of Fluor Hanford’s processes and systems prior to corporate year-end

## SOX 404 & Internal Audit Requirements

- COSO defines internal controls as “a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives” in 3 categories:
- Effectiveness and efficiency of operations;
- Reliability of financial reporting; and
- Compliance with applicable laws and regulations

## SOX 404 Objectives vs Internal Audit Objectives

- Sarbanes-Oxley scope does not include:
- Measure the effectiveness and efficiency of operations
- Compliance with applicable laws, regulations
- Compliance with prime contract terms & conditions
- Utilization of best business practices

## SOX 404 – Lessons Learned

- Fit the testing to meet the needs of your company
- One size does not fit all organizations
- SOX compliance requires a continuous effort and commitment by the entire team
- Training is a necessary component of this process
- Coordination across organizations is a must

## How Can You Help?

- Support an environment that facilitates effective & efficient internal controls
- Continue to evaluate how processes are working
- Comply with existing policies and procedures & participate in updates as processes change
- Identify internal control weaknesses & work to strengthen them
- Identify gaps in documentation & work towards closing them

## Questions???