Responsible individuals, even if they have not had serious health issues in recent years, still have regular medical checkups. Similarly, companies whose ICOFR programs appear to be running smoothly should still periodically evaluate the health of their ICOFR program and controls portfolio. In addition to identifying and correcting potentially unhealthy aspects of the programs or control problems before they occur, a well-designed evaluation (health check) can provide significant insights:
Future papers in this series will look at these points in detail. The rest of this paper will delve into how the evolution of Sarbanes-Oxley 404 (SOX) has impacted ICOFR programs and offer insights on how to evaluate whether your company’s ICOFR program is providing value as a mature, "healthy" program should.