That framework of controls, called COSO 92, was already 14 years old, and ten years old when Sarbox became law. It was actually a revision of an older standard that was repurposed for the rule. The IMA wanted the SEC to consider an alternative, “practical, risk based approach” that was less “auditor centric” and took “full account of the many advances over the past 30 years in the fields of risk management, quality and internal control”.
Despite four months of letters to the SEC and Congress by the IMA, a meeting with the SEC and Public Company Accounting Oversight Board, and testimony to Congress, the SEC and Congress did not move forward on the IMA’s suggestion.
Tim Leech, the primary author of the paper for the IMA, says the failure to properly address the issues raised by the IMA led to inadequate implementations of Sarbanes-Oxley. Rules about “integrity, ethics and competence” were specifically excluded from COSO 92, according to a recent article by Leech in Cost Management. Leech believes those and other fatal flaws resulted in failures of companies to adequately address risk and pay measurements.
If these concerns sound familiar, they should. Pay and failures of measurement and oversight of risk have been cited as being major drivers that contributed to the financial crisis and “Great Recession.” Integrity, ethics and competence have also figured prominently in the mix.