4.3J-SOX (the internal control reporting system)

The internal control reporting system (J-SOX), under the Financial Instruments and Exchange Act, requires the management of a listed company to self-assess "whether its own internal control over financial reporting functions effectively" and to disclose the result as an internal control report. An external auditor (audit firm) then audits whether that report is fairly stated. Systems auditors and IT auditors are involved in this system because, in an era when much of financial reporting is processed by IT systems, IT controls determine the reliability of financial reporting. Grounded in the J-SOX framework, reasonable scope narrowing, and the classification of deficiencies by severity, this section builds the viewpoint from which an auditor decides "where to focus the evaluation."

4.3.1The J-SOX framework

• The internal control reporting system (J-SOX) is a system under the Financial Instruments and Exchange Act that requires listed companies to have management self-assess the effectiveness of internal control over financial reporting and submit an internal control report together with the securities report. Its purpose is ensuring the reliability of financial reporting, and a defining trait is that it focuses not on all operations but on the "over financial reporting" scope.
• J-SOX involves two parties. First, management self-assesses internal control and prepares the report (management's responsibility); then an external auditor (audit firm) audits that internal control report as an integrated part of the financial statement audit (the auditor's responsibility). Management's assessment and the audit are separated in role; the auditor does not design or operate internal control on behalf of management (maintaining independence).

4.3.2Scope narrowing and deficiency classification

• Management's J-SOX assessment uses a top-down, risk-based approach. Rather than evaluating all operations uniformly, it narrows the scope to areas with a material impact on financial reporting (significant business locations, accounts, and business processes) from the standpoint of financial materiality and concentrates evaluation resources there. Company-level internal control (the control environment, etc.) is evaluated first, and internal control over business processes is then evaluated in light of that result.
• Internal control deficiencies are classified by severity. A deficiency with a high likelihood of causing a material misstatement in financial reporting is deemed a material weakness that should be disclosed, leading to disclosure in the internal control report that "internal control is not effective." The distinction between a mere deficiency (not material) and a material weakness that should be disclosed is judged from the standpoint of the materiality and likelihood of the impact on financial reporting.

Suppose a systems auditor (in charge of IT audit) is evaluating the IT controls of a sales management system as part of an internal audit supporting listed company B's J-SOX compliance. B's internal audit department believes "the IT controls of all business systems should be evaluated exhaustively at the same depth" and is trying to scrutinize every system—accounting, sales, HR, inventory, and even the internal portal—uniformly. The judgment the auditor should make here is that J-SOX targets internal control "over financial reporting" and should narrow the scope, via a top-down risk-based approach, to areas of high financial materiality. For example, the sales management system directly tied to revenue and the accounting systems at consolidation-significant locations are central to the scope, but evaluating even part of an internal portal with little impact on financial reporting at the same depth is not a reasonable allocation of resources. Next, suppose that in evaluating the sales management system the auditor finds a deficiency: "a change with insufficient testing was made to the order-amount auto-calculation logic, and under certain conditions revenue could be overstated." The auditor must evaluate this from the standpoint of the materiality of the impact on financial reporting (the monetary impact) and its likelihood, and if it has a high likelihood of causing a material misstatement, treat it as a material weakness that should be disclosed. There are two traps here. One is the misconception that "evaluating all systems uniformly is exhaustive and therefore a good audit"—J-SOX's principle is narrowing (top-down) based on financial materiality. The other is the misconception that "a system bug is entirely a technical problem for the IT department and unrelated to J-SOX"—an IT-control deficiency that can distort the figures in financial reporting is precisely the kind of internal-control deficiency J-SOX targets. The auditor judges the depth of evaluation and the severity of deficiencies in light of the goal of reliable financial reporting.

4.3.3Section summary

• J-SOX = under the Financial Instruments and Exchange Act, management self-assesses internal control over financial reporting and submits an internal control report, which an auditor audits
• Management's assessment narrows the scope to areas of high financial materiality via a top-down risk-based approach (not all operations uniformly)
• A deficiency with a high likelihood of causing a material misstatement in financial reporting is treated as a material weakness that should be disclosed