By Connie Spinelli, GRC Solutions
By now your company is likely in the Sarbanes-Oxley Section 404 mode. As internal auditors you are once again pondering what to do with what used to be SAS 70 reports, realizing that this year the issues are more complex. This article addresses the question: What are my organization’s responsibilities to review the sufficiency of SOC reports received, as related to the internal Sarbanes-Oxley program or required by my external auditors?