Fluor Hanford Internal Audit Sarbanes Oxley 404

1
Fluor Hanford Internal AuditSarbanes Oxley 404

• Dianne Jackson
• Senior Director

2
SOX Objectives

• Increase transparency in financial reporting
• Aimed at improving the accuracy and reliability
  of corporate disclosures
• Tighten time frames for filing 10-Qs 10-Ks
• Expand rules for Audit Committees
• Executive certification of quarterly/annual
  reports
• Broaden requirements for Internal Controls (404)

3
SOX 404 Implementation

• Implementation will be expensive
• Implementation will require time for planning and
  coordination of various internal departments
• Risks related to each business process will need
  to be identified and analyzed
• Roles of Internal Audit will need to be
  established

4
SOX 404 Questions to Ask

• Does this corporate requirement extend to Fluor
  Hanford?
• Is this effort reimbursable?
• How does IA dedicate staff to Sox and still get
  the audit plan completed, as required?
• How involved will other FH organizations be?
• What business processes are within scope?

5
SOX 404 More Questions to Ask

• What does FH control structure look like?
• Who is the process owner?
• Who is accountable?
• How does it deal with change?
• Is all of this documented?
• Can IA use the flow diagrams and narratives IA
  previously developed?
• How will IA demonstrate that we have reviewed the
  controls throughout the year?
• How does IA plan for such an unknown?

6
SOX 404 Internal Audits Role

• Performed walk throughs and documented the
  current control system narratives
• Performed segregation of duties evaluation
• Designed and performed tests of key controls
• Identified gaps and evaluated mitigating controls
• Issued final report to management and DOE
• Conducted follow up additional tests of controls

7
SOX 404 Fluor Hanford Scope

• Seven business processes were identified
• 102 Controls were within scope
• 74 Tests developed and performed
• 6 Internal Auditors trained

8
SOX 404 FH, Internal Audit Resources

• CY 2004
• 6 Auditors 780 Hours
• CY 2005
• 4 Auditors 332 Hours
• CY 2006
• 3 Auditors 430 Hours

9
SOX 404 Post Internal Audit Testing

• Fluor Hanford CIO performed self-assessments on
  critical business systems
• Information System Audit teams performed
  validations on the Fluor Hanford critical
  business systems
• External Auditors reviewed self-assessments,
  validations and conducted their own tests of
  Fluor Hanfords processes and systems prior to
  corporate year-end

10
SOX 404 Internal Audit Requirements

• COSO defines internal controls as a process,
  effected by an entitys board of directors,
  management and other personnel, designed to
  provide reasonable assurance regarding the
  achievement of objectives in 3 categories
• Effectiveness and efficiency of operations
• Reliability of financial reporting and
• Compliance with applicable laws and regulations

11
SOX 404 Objectives vs Internal Audit Objectives

• Sarbanes-Oxley scope does not include
• Measure the effectiveness and efficiency of
  operations
• Compliance with applicable laws, regulations
• Compliance with prime contract terms conditions
• Utilization of best business practices

12
SOX 404 Lessons Learned

• Fit the testing to meet the needs of your company
• One size does not fit all organizations
• SOX compliance requires a continuous effort and
  commitment by the entire team
• Training is a necessary component of this process
• Coordination across organizations is a must

13
How Can You Help?

• Support an environment that facilitates effective
  efficient internal controls
• Continue to evaluate how processes are working
• Comply with existing policies and procedures
  participate in updates as processes change
• Identify internal control weaknesses work to
  strengthen them
• Identify gaps in documentation work towards
  closing them

14
Questions???