SOX2年目の調査 by ISACAのメンバー

　こんにちは、丸山満彦です。ISACAからSOX法適用2年目に関する調査結果（速報版）が公表されています。調査は2006年4月12日から15日にかけてオンラインで実施され、約740名のISACAメンバーが回答しています。

　
■ISACA
・ISACA and ITGI Provide Comment Letter to SEC and PCAOB
・・Preliminary ISACA Survey Results

【質問項目】（一部分析中）

01. Do you think additional guidance for 404 compliance, directed at management of companies, would be helpful?
　必要という意見が多いようです。

02. Did the SEC/PCAOB guidance issued in May 2005, recommending a risk based, top down, approach reduce the scope of managements' 404 work?
　あまり効果がないようです。増加したという意見もあるようです。日本の基準はこのガイダンスをはじめから採用しているので会社の負担が少なくなるといっていますが、実務上は・・・

03. Do you believe there is a need for separate guidance for issuers and public accounting firms?
　必要。ただし、ばらばらはだめですね。会計ルールに相当するものですから利害関係者で統一したものをつくることが必要。この点は日本のアプローチのほうが正しいような気がします。

04. In year two, what was your best source for addressing IT controls? (if more than one used, please check the top two only)
　約半数は、IT control objectives for SOXを利用。監査人は以前からIT全般統制などの評価のためのデータベースを持っていますから、それを活用したいという意見もあるようですが、IT control objectives for SOXがこれからは使われるのでしょうかね。。。

05. How much time was saved for the 404 attestation by having your organization's management working closer with your public accounting firm?
　関係なしが多いですね。独立性の問題もあるので、難しいところですね。

06.1 Did your public accounting firm take into account entity level controls in determining their level of testing in year two?
　同意が約半数。
　
06.2 What was the impact (reduction in work) to amount of work expended by your accounting firm by utilizing an entity level approach?
　ほとんど関係なしという回答が多いようですね。

07. Did your organization use software to assist with 404 compliance?
　使っているところと使っていないところで半分ずつ。

08. The testing approach in year two differed from the testing approach used in year one by: (please check the top two only, if more than one applies)
　範囲と、評価するテストの数が多いですね。

09. If you used e-mail to evidence approvals did you include the e-mail system in the scope of Sarbanes-Oxley?
　約60%は関係ないと・・・

10. Regarding your organization's IT approach, did you adopt the same standard of control for smaller subsidiaries as for larger subsidiaries or did your organization utilize the draft COSO for Small?
　約60%は同じと・・・

11. What IT governance/control frameworks did your company use for year two? (if more than one used, please check the top two only.)
　約60%はCOBIT。

12. How easy or difficult was the IT control framework to use?
　簡単と難しいがおおむね半数ずつ。

13. Where did your staff obtain training on using the IT control framework?
　約60%は社内。

14. The type of external expertise relied on to implement the IT control framework was: Consultant, CISA, External auditor or CISM?
　コンサルタント30%、CISAと外部監査人が約25%ずつ。

15. Did you change the IT control framework from year one to year two?
　ほぼ半数は変化なし。

16. Are spreadsheets used as an integral part of the financial reporting process?
　約75%はスプレッドシートコントロールも対象となっているようですね。

17. Is end user developed software used as an integral part of the financial reporting process?
　半数以上は対象となっているようですね。

18. Has the 9 firm (public accounting firms) "Conclude framework" been used or adapted to address general computer controls and potential deficiencies?
　ほとんど利用されていない？

19. Was sustainability addressed as part of the year two processes or part of year three planning?
　約60%がYES。
　
20. Did sustainability include the need for an IT controls framework?
　約半数がYES。

21. In your organizations year two efforts, did your sustainability efforts consider?
　ITコントロール、プロセスコントロール、ビジネスプロセスでほとんどですね。

22. If your organization relied on manual controls for information generated by computer-based reports, how was the evaluation and reporting of manual control procedures integrated with IT controls? (Responses still being analyzed.)

23. In year two, what percentage of key controls that your organization identified were considered "automated" key controls?
　ざくっと25%くらいが平均なのでしょうか？

24. Was there an increase in the automation of key controls in year two versus year one?
　増加したところと、していないところが半分ずつ。

25. Describe any other significant trends in the results of control testing and subsequent evaluations. (Responses still being analyzed.)

26. In year two, did your organization increase its emphasis in testing application controls?
　半数以上が同意していますね。

27. Additional comments related to their organizations’ year-two experiences were provided by 237 respondents：