EXAMINING THE SAS 300 REQUIREMENT FOR EFFECTIVE INTERNAL CONTROL PROCEDURES
Statement of Auditing Standard (SAS) 300 emphasizes the importance of the role of effective internal control procedures in corporate governance, along with the need for auditors to be fully familiar with the internal control systems in organizations that they are called upon to audit (Auditing Practices Board, 1995). SAS 300 was issued by the Auditing Practices Board in 1995 ("Introducing the new SASs," 1995). Before the 1995 version of SAS 300 was issued, SAS 300 dealt only with risk assessment. The 1995 version deals with both risk assessment and internal controls ("Revision Of Auditing Standards And Guidelines," 1993). The SAS 300 requirements noted above are investigated within the context of three focal issues, as follows: (1) the essentials required for an effective internal control function are examined; (2) the effects of the SAS 300 requirements on the internal audit function are discussed; and (3) actions that should be taken by an external auditors to establish the reliability internal audit data are considered.
Essentials Required for An Effective Internal Audit Function
The Report of the Committee on the Financial Aspects of Corporate Governance, more generally known as the Cadbury Report taken from the name of the Committee Chair Adrian Cadbury, noted that "an effective internal control system is a key aspect of the efficient management of a company" (Committee on the Financial Aspects of Corporate Governance, 1992, Section 4.32). The Committee went on to enumerate a number of actions that they considered to be essential for an effective internal control function within an organization. These essential actions were as follows: (1) the directors of an organization should report on the effectiveness of their system of internal control, and this report should be included in the organization's annual report; and (2) organizations should...